Use non auth URL for cloning

Otherwise we have to assume GH has the developers public key