Currently `NPM config file` function provided by nodejs plugin only support `_auth` or `username` `_password` combination. As the `_auth` and `_password` are base64 encoded, they are easily be decoded and the original password will be exposed.

Suppose revoking tokens is more convenient than changing password, I propose that we support `_authToken` in npm config file.