include note on why npm should not be run as root