scan() has a simple validation logic.

The validation logic is really simple: if disallow appears before
user-agent appears first time in the document, we raise exception.