use personal access token instead of Github master password

way safer