need to check scopes before storing token

lib/travis/api/app/endpoint/authorization.rb

@@ -205,10 +205,10 @@ class Travis::Api::App
         def user_for_github_token(token)
           data   = GH.with(token: token.to_s) { GH['user'] }
           scopes = parse_scopes data.headers['x-oauth-scopes']
-          user   = UserManager.new(data, token).fetch
-
-          halt 403, 'not a Travis user'   if user.nil?
           halt 403, 'insufficient access' unless acceptable? scopes
+
+          user   = UserManager.new(data, token).fetch
+          halt 403, 'not a Travis user' if user.nil?
           user
         end