This breaks updating private repositories for me.  I believe the token is being passed into the [boxen-git-credential script](https://github.com/boxen/our-boxen/blob/master/script/boxen-git-credential).  Are you sure that tokens can be used as passwords in this case?