Use CDN for Underscore.js

This also fixes SSL.