use HTTPS url for submodules