Use git repo/ tarball for "npm update" rather than npm repo

This would fix #2374 and #2419 (which seems to be [incorrectly closed](https://github.com/isaacs/npm/issues/1727#issuecomment-17426135) as a dupe of #1727).

Instead of checking whether the original source (git/ https? tarball) has an update available, but then only considering the npm repository for the update, this PR will update from the source instead.

I'm open for ideas whether the PR should be changed so that it checks the npm repo either first, or as a fallback, but as npm checks **the source** to see whether an update is available, it makes little sense to retrieve the update from the npm repository.