switch submodule to https: to make read-only checkout easier