issue #24559 - backport to 4.6.1

backport fix and bump version for web-only release
I'm inclined to say that because the xtuple server doesn't use install_xtuple.sh, then it doesn't matter.

But, sure, you might as well peg to an npm patch release. 4.6.1 *will* be our most recent release for a day, until we publish 4.7.0, so we might as well tighten up npm for it, too.