submodules use https:// for read-only