Nimble Publish Command Security Leak
I used `nimble publish` command to publish my first nimble package recently. Nimble automatically added my github security token into the nimble package list and pushed it to github. It was something like this.
```
"url": "https://15b1acb3d21ebde45e8ab271e72fb4a75ad40143:x-oauth-basic@github.com/henryas/nptr"
```
Github automatically detected the leak and revoked the token.

It is better for Nimble to ask for the url, than trying to figure things out on its own and expose someone's security credential. This needs fixing.