For useabilityusability, your form shouldn't even allow posting until it's valid. With that:
In the login form, the password is blank or the password/email combination is incorrect. When the form is posting(before making he call to the action), it first should be validated and appropriate messages should display next to the offending field. No resetting of fields
In the change password form, the password does not meet password requirements (mininum length, etc). You should provide instant feedback to the user on their password strength. No resetting of fields unless your requirements cannot be mirrored in a client side javascript
In the change password form, the repeated password does not match the password.You should provide instant feedback to the user that the passwords do not match. No resetting of fields
In the change password form, a blank password field exists. Again, don't allow posting until the form is valid
It's very inconvenient when filling out a form and it resets all the values after it tries to post. If it's valuable information, the user will most likely get annoyed and just leave the site...
If the authentication fails, then yes; blank out the password since it's apparently not valid. Although the username could be incorrect, it's your call if you want to validate that the user account exists and not blank it out on refresh.
Finally, whatever you do, be consistent!
