Lock underscore version

Since it's not semver compliant
No idea how version got changed
Merge pull request #45 from AmpersandJS/semver

Lock underscore version