omit password hash values from HTML

The local user accounts management form used to use password hash value
to indicate that there is no change to the password. Stephan Rickauer
points that exposing the hash value isn't good with the rainbow tables
attack in mind. Use an empty string for that purpose instead.

* renderUserListEditor()
* updateUser()