always-auth can be scoped per registry

Needed to deal with npm/npm#6201.

/cc @isaacs because I'm not sure that JSON.parse() is legit.
```
var val = this.get(nerfed + ":always-auth")
if (val === "false") val = false
else val = !!val
```