From testing:
GETing /users/someusername/repos doesn't show private repos (even if it's the user whose oauth access token you're using).
GETing /user/repos show private repos.
This isn't documented in the GitHub API docs at present, I just found out via testing.
Thanks to @ivanzuzak for suggesting to look at the endpoint.