Do not fill in passwords fields on failure.

lib/devise/controllers/helpers.rb

@@ -78,9 +78,12 @@ module Devise
         instance_variable_set(:"@#{resource_name}", new_resource)
       end
 
-      # Build a devise resource
+      # Build a devise resource without setting password and password confirmation fields.
       def build_resource
-        self.resource = resource_class.new(params[resource_name])
+        self.resource ||= begin
+          attributes = params[resource_name].try(:except, :password, :password_confirmation)
+          resource_class.new(attributes)
+        end
       end
 
       # Helper for use in before_filters where no authentication is required.