Another attempt to solve this download-on-install issue

(Almost) back to original behavior: no installing by default **at all**. Though, this keeps it around if the user wants to request it via the env var. (also see #40 for prior discussion)

Instead: upstream packages can request downloads themselves (potentially in an install-time script), which gets around the [npm timing bug](https://github.com/npm/npm/issues/6624). For example: https://github.com/Polymer/web-component-tester/blob/master/scripts/postinstall.js