use /-/whoami endpoint instead of /whoami

Allows to get rid of referer magic, so it's a nice change to have.

See this issue for details:
https://github.com/npm/npm-registry-client/issues/88
fix dist.tarball replacement logic
1.0.0-alpha.3
marked -> render-readme
fix path to helpers.less
update dependencies
disable source maps & rebuild
web: change header position from fixed to static

Mainly because anchors (`<a name=...>`) need to be offsetted to
account for the fixed header, and it ain't worth the hassle.