Add additional logging. Log npm install failures.

Before this patch, a failure during npm module installation would leave no
evidence in the gardener logs, making it hard to figure out why modules weren't
getting installed.

Fixes https://github.com/garden20/gardener/issues/19.

We should also strip passwords from URLs whenever we log them. There's one in
this patch, and a whole bunch that are generated by npm and dutifully recorded
as-is by gardener. I'll create a separate issue for that; we just need a routine
that finds and obscures anything that looks like a password in an HTTP/HTTPS
URL.