fix(npm): don’t authorize public non-scoped packages

The authorization header can interfere with caching because npmjs doesn’t return “public” in the “Cache-Control” header.