npm: upgrade to v1.4.9

* Send referer header (with any potentially private stuff redacted)
* Fix critical typo bug in previous npm release
Merge remote-tracking branch 'upstream/v0.10' into v0.10