fetch by URL, so credentials aren't stored in .git as remote.origin.url