I don't think that the setting should be done this way.  Instead, it should simply set a flag *for this request* to send auth.  If other requests come by that are *not* `npm://`, then we don't want to send auth unnecessarily.