submodule uses https