npm 1.5 candidate

This is still work in progress, but enough done for the client to be usable for most stuff. It's now ready for people to bang on it and see what breaks.

The biggest new features in this branch:

* [scopes](https://github.com/npm/npm/issues/5239)!
  * create and manage scopes (`npm config set @myscope:registry http://registry.private.com`)
  * install and publish scoped packages ‡
  * do things on a scope's registry using the `--scope` parameter (e.g. `npm login --registry=registry.private.com --scope=@myscope`)
* auth via bearer token ‡
* all credentials are tied to a registry by its URL (you will need to log in to all the registries you use again, but now you can be logged into multiple registries simultaneously, and multiple scopes on a single registry as different users)
* simplified the caching process considerably

‡  requires registry support, availability on registry.npmjs.org TBD

Status:

  - [x] recognize scoped package specifiers
  - [x] update npm-registry-client to not double-escape scoped package names
  - [x] send `//registry.host.com:8081/:_authToken` with outbound requests for scoped package data
  - [x] ensure that scoped packages install all the way
  - [ ] write test to verify that remapping is working correctly
  - [x] wrap all `registry.get` calls in `mapNameToRegistry`
  - [ ] write tests for all modules affected by the previous change
  - [x] open [pull request](https://github.com/npm/normalize-package-data/pull/46) on `normalize-package-data` to support scoped package names
  - [x] open [pull request](https://github.com/npm/read-package-json/pull/40) on `read-package-json` to use updated `normalize-package-data`
  - [x] merge PR for `normalize-package-data` into master and update `read-package-json` to depend on updated version
  - [x] merge PR for `read-package-json` into master and update `npm` to depend on updated version
  - [x] open [pull request](https://github.com/npm/npm-registry-client/pull/51) on `npm-registry-client` to make it handle scoped package names consistently
  - [ ] merge PR on `npm-registry-client` for scoped package names into master
  - [x] support publishing scoped packages
  - [x] write test for scoped package publishing
  - [x] support `npm adduser --scope=bigco --registry=registry.big.co`
  - [x] open [pull request](https://github.com/npm/npmconf/pull/31) on `npmconf` to support scope as a config parameter
  - [x] merge PR for `npmconf` into master and update `npm` to depend on updated version (after rebasing on `1.0.5` after @isaacs pushes them to `npmconf` master)
  - [x] capture `//registry.host.com:8081/:_authToken` on login
  - [x] move all credentials to be scoped per registry
  - [x] *only send a bearer token* or *basic auth, not both (or pieces of both)*
  - [x] incorporate @isaacs's `npm-registry-couchapp` integration tester into this PR (and ensure the tests are passing)
  - [x] *add server-side fetching of `whoami` so that username is as correct as we can make it*
  - [ ] add migration shim for top-level legacy `_auth`
  - [ ] documentation updates
  - [ ] merge `othiym23/capture-token` into master
  - [ ] merge this PR into master
In this case, it doesn't make a difference, because parsing the spec doesn't make alter it in the case of local specs, but I'll change it for consistency's sake.