update ci user

token is ok to be public since it's only for the hub-ci