use more secure download addresses