There is also an underscore block in hqwebapp/base.html

I argued that if Vellum is depending on underscore then in order to avoid the (perhaps small) potential of future breaking changes in a new version of underscore used in HQ, it needs to either explicitly document what version of underscore it requires and CommCare HQ should ensure that it provides an appropriate version, or it needs to include a copy of underscore and let HQ use that on the appropriate page.  If the rest of the page ends up needing to use the later version of underscore then it's time to start using http://requirejs.org/