Make DocumentSetWorker not insert wrong projectid.

No idea why this wasn't affecting production or anybody else. It's
clearly wrong?
Remove bcrypt from UserSpec