don't warn if private = true

This fixes isaacs/npm#3490 where the conclusion is, that if
the package.json has a private = true, it should not warn.