Add name/version just like a normal remote tarball

This strips out build directories and the like, which can in some cases
end up in registry tarballs.

Also, add a todo about the shasum thing.  Gotta get to that soonish.

lib/cache.js

@@ -129,6 +129,7 @@ function add (args, cb) {
   else addLocal(pkg, cb)
 }
 function addRemoteTarball (url, cb) {
+  // todo: take a shasum, and validate it.
   var tmp = path.join(npm.tmp, Date.now()+"-"+Math.random()+".tgz")
   fetch(url, tmp, function (er) {
     if (er) return log.er(cb, "failed to fetch "+url)(er)
@@ -139,17 +140,10 @@ function addNameVersion (name, ver, cb) {
   registry.get(name, ver, function (er, data, json) {
     if (er) return cb(er)
     deprCheck(data)
-    var folder = path.join(npm.cache, data.name, data.version)
-      , tgz = path.join(folder, "package.tgz")
-    mkdir(folder, function (er) {
-      if (er) return cb(er)
-      if (!data.dist || !data.dist.tarball) return cb(new Error(
-        "No dist.tarball in package data"))
-      fetch(data.dist.tarball.replace(/^https/,'http'), tgz, function (er) {
-        if (er) return cb(er)
-        addLocalTarball(tgz, cb)
-      })
-    })
+    if (!data.dist || !data.dist.tarball) return cb(new Error(
+      "No dist.tarball in package data"))
+    // todo: put the shasum in the data, and pass to addRemoteTarball
+    return addRemoteTarball(data.dist.tarball.replace(/^https/,'http'), cb)
   })
 }