Check for ErrorResponse before CSRF

It's possible there's an error that explains why the state token isn't
as expected. It should be fine to report those details before verifying
CSRF.

src/Yesod/Auth/OAuth2/Dispatch.hs

@@ -81,8 +81,8 @@ dispatchCallback
     -> FetchCreds site
     -> m TypedContent
 dispatchCallback name oauth2 getToken getCreds = do
-    csrf <- verifySessionCSRF $ tokenSessionKey name
     onErrorResponse $ throwError . OAuth2HandshakeError
+    csrf <- verifySessionCSRF $ tokenSessionKey name
     code <- requireGetParam "code"
     manager <- authHttpManager
     oauth2' <- withCallbackAndState name oauth2 csrf