subrepo: only attempt pulling from git's origin
git fetch does not accept repository URLs as arguments, and the intended
logic of this code was not actually doing anything.
sshrepo: catch passwords in ssh urls
see also
e4b02eb825b1
changegroup: fix typo introduced in
9f2c407caf34