private repositories

changes to better support private repos:
    - check the real username when an auth token is provided (error if
      it doesn't match)
        - this caused an infinite loop between get_auth/retrieve_data,
          so I added a parameter to retrieve_data to escape that
    - error if you pass -P but someone else's username
    - optionally use SSH instead of HTTPS to clone