use HTTPS links for downloads