Check the nonce before the user capabilities

It's cheaper, and it will prevent issues with programmatic saving, e.g. via wp-cli