don't reset user passwords on bulk upload

It also displays "********" for uploaded passwords instead of nothing.  Incoming passwords that are "********" for existing users won't be changed, empty fields will error, and new users need a password that's not empty or "********".