[enh] download via https. fixes #1