use always-auth from credentials instead of config

This depends on new behavior in npmconf! This is a hidden dependency between `npm-registry-client` and `npmconf` that evades semver! It makes me *very uncomfortable!*