use always-auth from credentials instead of config

This depends on new behavior in npmconf!