Treat dep. as outdated if its _from changes

This is per Isaacs comment in #1727
use getCacheStat before lock, fixes joyent/node#3821

Previous code did not handle the cache dir's permissions consistently.
If the first lock was done as sudo, the cache directory was not user
writable.
Removed the now unnecessary guard and collapsed the then function.
doc: Fix typo
Guard against falsey versions value.
use npm-registry-mock, fixes #3633
doc: Clarify versions and mention prepublish
add "repo" command
v1.3.8
v as alias for view command
npm view doc
add missing aliases to cli doc pages
Document `user/repo` style GitHub URLs