Fixed *two* bugs in InstanceVariableSetter.

Also killed `InstanceVariableSetter#allow_attributes`. It's a feature
that (as it now turns out) our two uses of this class never use; both
use what the spec calls callback initialisation.

Next up: killing one of those two uses; namely, that in `UserEntity`.

RSpec: 707 examples, 0 failures
RuboCop: 181 files inspected, no offenses detected