use https URLs for fetch