submodules: https rather than ssh (for public access).