Preserve already-set passwords, but don't touch the iterations property (mistakes there, currently, can cause password hashing at authentication to loop endlessly). Be tolerant of externally-created users.