npm: upgrade to v1.4.9

* Send referer header (with any potentially private stuff redacted)
* Fix critical typo bug in previous npm release