explicitly fetch private repos with oauth token