Ensure user has pull access before starring

[skip ci]