Improve robustness of user update workers

Gracefully handle:

* The user no longer existing
* The application no longer existing
* The user no longer having any permissions for the application

Any of these can change between when a job is scheduled, and when it's actually run.