Enable 2FA when publishing a new package #288

See: https://blog.npmjs.org/post/175861857230/two-factor-authentication-protection-for-packages

I have suggested this as a setting in the npm account page too, but no point in waiting for them.

This is blocked by https://github.com/npm/cli/pull/11 becoming available in a stable npm release.