The list edit dumped the whole table row into update(); whitelist form and accounting fields, and skip hashing an empty password. Co-authored-by: Cursor <cursoragent@cursor.com>