use https for downloads