Cant use mapbox-gl in private npm registries requiring _auth

Nobody has claimed this yet.

**mapbox-gl-js version**:
All versions
### Steps to Trigger Behavior

1. add the following .npmrc file:
```
_auth=test123
```
2. Run the command
```
npm i mapbox-gl
```
3. Should get the following output (make sure npm isn't caching)
```
bash-3.2$ npm install mapbox-gl
npm ERR! code E404
npm ERR! 404 Not Found - GET https://registry.npmjs.org/@mapbox%2fgeojson-rewind - User not found
npm ERR! 404
npm ERR! 404 '@mapbox/geojson-rewind@^0.4.0' is not in the npm registry.
npm ERR! 404 Your package name is not valid, because
npm ERR! 404 1. name can only contain URL-friendly characters
npm ERR! 404 It was specified as a dependency of 'mapbox-gl'
npm ERR! 404
npm ERR! 404 Note that you can also install from a
npm ERR! 404 tarball, folder, http url, or git url.

npm ERR! A complete log of this run can be found in:
npm ERR! /Users/kjin/.npm/_logs/2019-04-24T04_23_29_281Z-debug.log
```

Several private npm registries such as Artifactory and Nexus use `_auth` in .npmrc for authentication, and this issue prevents users from installing mapbox-gl

Related issues:
https://github.com/xtuc/webassemblyjs/issues/462
https://github.com/mapbox/geojson-types/issues/1

Reproduce the installation using the .npmrc containing _auth=test123 and npm i mapbox-gl, ensuring npm is not using its cache. Trace the package metadata and dependency resolution involved in fetching @mapbox/geojson-rewind. Done means mapbox-gl installs successfully for registries that use _auth, without the dependency being misresolved or reported as missing.

Written by the indexing model from the issue text.