How to keep the password on a form when validation fails?

This is a general .NET issue/behavior pattern. If you set the TextBox control TextMode to Password, .NET will automatically discard your value. You either need to change the TextMode to e.g. SingleLine, meaning the password will be displayed in plain text, or you can add the following line of code to the Page_Load method in the code behind file of the given form control.

<textbox_name>.Attributes["value"] = <textbox_name>.Text;

For example, if you wish to change the Password form control, you need to modify the file ~\CMSModules\Membership\FormControls\Passwords\Password.ascx.cs by adding the following line at the beginning of the Page_Load method:

txtPassword.Attributes["value"] = txtPassword.Text;