Do not copy password hash nor reset from user

modules/web_user/user.py

@@ -161,6 +161,13 @@ class User(avatar_mixin(100), DeactivableMixin, ModelSQL, ModelView):
                 user.email = email
         cls.save(users)
 
+    @classmethod
+    def copy(cls, users, default=None):
+        default = default.copy() if default is not None else {}
+        default['password_hash'] = None
+        default['reset_password_token'] = None
+        return super().copy(users, default=default)
+
     @classmethod
     def create(cls, vlist):
         users = super(User, cls).create(vlist)

trytond/trytond/res/user.py

@@ -439,7 +439,8 @@ class User(avatar_mixin(100, 'login'), DeactivableMixin, ModelSQL, ModelView):
             default = {}
         default = default.copy()
 
-        default['password'] = ''
+        default['password_hash'] = None
+        default['password_reset'] = None
         default.setdefault('warnings')
         default.setdefault('applications')