Don't use the user's github credentials when downloading approved extensions

[riknoll]

If an extension is approved, it's definitely not a private repo. We should just go through the usual codepath when requesting the extension instead of using the user's github info because they may have organizational policies that thwart the request (like single sign on)