make app private, npm will refuse to publish it