use https sonatype urls, otherwise resolution fails