Don't echo secret token in Travis & new token

So it turns out the secret token ended up in the public Travis logs -
not ideal! - because we were using ``bash -x`` (echo).

Here's a new token and we disable bash output when doing the ``git
clone``.