only use https:// urls for submodules; they really are read-only