Further limit when we call pmap_fault.

We should only call pmap_fault in the kernel when accessing a userspace
address. As this should always happen through specific functions that set
a fault handler we can use this to limit calls to pmap_fault to when this
is set.

This should help with NULL pointer dereferences when we are unable to sleep
so we fall into the correct case.

Sponsored by: DARPA, AFRL