This is not the place in the code, but we actually may not need `user` in scope for accessing the github API. It may be off-putting to some users, and we do not really use profile information.
http://developer.github.com/v3/oauth/#scopes