Set private flag in package.json

Mainly to stifle warnings about not having a readme, but probably not
a bad idea otherwise.