don't track npm-debug.log in git