v0.4.2

Fixed

• refreshAfterUpgrade could squeeze in one extra poll past its timeout.
  The capped final sleep was followed by a fresh clock read, and a timer that
  fires a hair early relative to performance.now() bought one more
  validate() call. The last wait is now decided up front, so no network call
  starts after timeout. This is the only change since 0.4.1, which was
  tagged but never reached npm; install 0.4.2.