use unauthenticated git URLs