submodule update (https links instead of ssh)