Pull requests from people without write access can't ever be merged

[exitmouse]

Because they can't ever Travis build successfully, since the secure tokens are removed.

[exitmouse]

Can't ever be merged safely, I guess. Or merged from a phone.

[exitmouse]

The fix would be splitting out the part of travis which deploys, and only running that part on commits to master (not PRs).