Make having a token a non-fatal error, and swizzle a token w/o password into the password slot

Modern "tokens" can be used as passwords for basic auth; see 
https://help.github.com/articles/creating-an-access-token-for-command-line-use

As people may have a perfectly legitimate reason for having github.token set 
in their git config, this fatal error becomes a passthrough warning (when
.token but not .password is set).