update backbone & underscore deps

- uses ~ on purpose, because both aren’t that great about semver