all submodules should be cloned using https