Try checking TRAVIS_PULL_REQUEST instead of TRAVIS_SECURE_ENV_VARS

It feels like the wrong thing to do - I care about whether the secure env
vars are available - but that's the suggestion from
http://docs.travis-ci.com/user/pull-requests/#Security-Restrictions-when-testing-Pull-Requests