Another attempt to solve this download-on-install issue

(Almost) back to original behavior: no installing by default **at all**. Though, this keeps it around if the user wants to request it via the env var.

Instead: upstream packages can request themselves, which gets around the [npm bug](https://github.com/npm/npm/issues/6624). For example: https://github.com/Polymer/web-component-tester/blob/master/scripts/postinstall.js