Clarify what `npm install` does. Closes gh-407.