chore(docs): add npmrc docs about scoping auth related config

docs/content/configuring-npm/npmrc.md

@@ -91,6 +91,20 @@ consistent across updates.  Set fields in here using the `./configure`
 script that comes with npm.  This is primarily for distribution maintainers
 to override default configs in a standard and consistent manner.
 
+### Auth related configuration
+
+The settings `_auth`, `_authToken`, `username` and `_password` must all be
+scoped to a specific registry. This ensures that `npm` will never send
+credentials to the wrong host.
+
+```
+; bad config
+_authToken=MYTOKEN
+
+; good config
+//registry.npmjs.org/:_authToken=MYTOKEN
+```
+
 ### See also
 
 * [npm folders](/configuring-npm/folders)