use https for sonatype to workaround an issue where it redirects to https