Factor downloading out to minimize load-time dependencies

This works around (what appears to be) a npm bug during installation:
https://github.com/npm/npm/issues/6624