
this also was not clear from the original report that the pages where using encryption. i will log a bug that the user update page should ignore the password entry if left blank.

I don't think that I would leave the passwords un-encrypted for any website that I make, especially when security is a concern. :)