calculate hash of the tarball, not the base64 encoded tarball

the previous version set the incorrect shasum - it hashed the base64 encoded string instead of the hash of the tarball. This causes npm to refuse to install any package published with this version. 
Pass the encoding to the `Hash#update` to calculate the correct hash.

Luckily, when you published `npm@1.3.19` (which uses this version of npm-registry-client, and publishes uninstallable packages) you used this version of npm-registry-client, so you can't actually install that version,
and so there isn't a problem of people publishing modules that you can't install.