dep does not honor source in lock file

[pratikmallya]

I'm facing a lot of trouble with accessing internal github projects using dep.

I managed to get an inital lock and toml file using init, but ensure does not seem to use the sources specified in these files: it tries to access the https url instead of the git one, leading to errors when fetching.

Is this expected behavior? I would imagine ensure would be using the sources provided in the lock file.

[sdboyer]

is this a dupe of #860, perhaps?