add HEAD support to (root) manifest
fix recent modules to actually only fetch from root
add github.io as claimable source
https for gravatar