tighten up a few bits - don't assume git keys so use http