Explicitly depend on underscore package

New meteor doesn't include underscore implicitly, causing hashids to fail.