use per-registry bearer tokens if available
canonicalize registry URL to get _authToken
don't send both basic auth and bearer token
look for registry-specific auth

Also clean out some of this lint.
get scoped credentials in publish
compatible with npmconf@othiym23/new-credentials
whoami talks to an endpoint with bearer auth
normalize-package-data@0.4.0
nerfed enough
support bearer tokens and multiple registries