use `files` field in package.json for npm whitelist. fixes #217
Merge pull request #218 from twada/package.files

use `files` field in package.json for npm whitelist