Only use auth for cloning if the PR is private