some fixes for GitHub auth

- fix typo in github token auth (key is `access_token`, not `token`)
- Use GitHub auth when fetching blob API

The first fixes a bug where anyone trying to use GITHUB_API_TOKEN would not actually end up making authenticated requests.

The second is the cause of recent 403 errors, because we were making unauthenticated requests of the blob API. Adding github_client.fetch for fetching any URL with github auth (with a check that GitHub is the target).