fix #480: overwrite of user password if admin leaves empty