Remove authenticated? check in layout.
Send client ID and secret as parameters of requests to API.

As per http://developer.github.com/v3/#unauthenticated-rate-limited-requests

Apparently, the values set in the config block are not actually sent as query params; that has to be done explicitly.