EntityMetadataWrapper is missing "pass" property on user entity

Split off from #2224645: EntityMetadataWrapper missing "picture", "timezone" & "signature" properties for user entity.

Adding the pass property to both the get and set callbacks needs to be thoroughly tested as it has major security implications.