fixed submodule URIs (no username/password asking when you don't have push access anyway)