dev/source: advocate HTTPS instead of HTTP