use GitHub API to download archive in install_github

Fixes #466.
Can we please keep this as `auth`? And then can you squash?