Check download content shasums with SHASUMS.txt. fixed npm/npm#4541