submodule should be HTTPS to avoid redirect warning