Publish permission ignored allowing any authenticated user to publish

Hey,

Am I doing something wrong or is the `publish` permission totally ignored?

```
packages:
  "@*/*":
    access: $authenticated
    publish: none

  "*":
    access: $authenticated
    publish: none
```

I realize `none` isn't a special token, but both `none` and leaving `publish` empty still allows me to publish packages with `npm --registry example.com publish`.
