always-auth can be scoped per registry

Needed to deal with npm/npm#6201.

/cc @isaacs because I'm not sure that JSON.parse() is legit.