move repo/user validity check deeper

(but change repo check to allow repoPATT instead of just repoNAME)

This is because there are/will be some situations where access() is
called without those two checks being done (i.e., it is not only from
src/commands/access that it is called).

src/lib/Gitolite/Conf/Load.pm

@@ -67,6 +67,8 @@ my $last_repo = '';
 
 sub access {
     my ( $repo, $user, $aa, $ref ) = @_;
+    _die "invalid repo '$repo'" if not( $repo and $repo =~ $REPOPATT_PATT );
+    _die "invalid user '$user'" if not( $user and $user =~ $USERNAME_PATT );
     my $deny_rules = option( $repo, 'deny-rules' );
     load($repo);