[auth] Show friendlier error message when fetching current user fails

Hub is impossible to use from within GitHub Actions because specifying
GITHUB_TOKEN will trigger the code path where the `user` resource is
requested from the GitHub API to get the current login name, but this
resource is not available for that token.

This failure message was cryptic and misleading before as it was
sometimes presented as HTTP 401. This change ensures that the correct
HTTP 403 "Resource not accessible by integration" message is shown.

features/authentication.feature

@@ -241,6 +241,29 @@ Feature: OAuth authentication
     And the output should not contain "github.com username"
     And the file "../home/.config/hub" should not exist
 
+  Scenario: Credentials from GITHUB_TOKEN when obtaining username fails
+    Given I am in "git://github.com/monalisa/playground.git" git repo
+    Given the GitHub API server:
+      """
+      get('/user') {
+        status 403
+        json :message => "Resource not accessible by integration",
+             :documentation_url => "https://developer.github.com/v3/users/#get-the-authenticated-user"
+      }
+      """
+    Given $GITHUB_TOKEN is "OTOKEN"
+    Given $GITHUB_USER is ""
+    When I run `hub release show v1.2.0`
+    Then the output should not contain "github.com password"
+    And the output should not contain "github.com username"
+    And the file "../home/.config/hub" should not exist
+    And the exit status should be 1
+    And the stderr should contain exactly:
+      """
+      Error getting current user: Forbidden (HTTP 403)
+      Resource not accessible by integration\n
+      """
+
   Scenario: Credentials from GITHUB_TOKEN override those from config file
     Given I am "mislav" on github.com with OAuth token "OTOKEN"
     Given the GitHub API server:

github/client.go

@@ -921,14 +921,15 @@ func (client *Client) FindOrCreateToken(user, password, twoFactorCode string) (t
 	return
 }
 
-func (client *Client) ensureAccessToken() (err error) {
+func (client *Client) ensureAccessToken() error {
 	if client.Host.AccessToken == "" {
 		host, err := CurrentConfig().PromptForHost(client.Host.Host)
-		if err == nil {
-			client.Host = host
+		if err != nil {
+			return err
 		}
+		client.Host = host
 	}
-	return
+	return nil
 }
 
 func (client *Client) simpleApi() (c *simpleClient, err error) {