use /-/whoami endpoint instead of /whoami

Allows to get rid of referer magic, so it's a nice change to have.

See this issue for details:
https://github.com/npm/npm-registry-client/issues/88
fix dist.tarball replacement logic