no https for curl installs without CAs