Lock underscore to 1.6.0

Something seems to have changed with `_.clone`, it breaks.