If an authenticated user pushed to a repository with server
hooks it was possible to execute those hooks even the user
has no write permission.

So let's re-order the hooks to execute the deny hook first.