TL;DR :

Вид

// add in your view `app/View/Users/edit.ctp`
// a 'fake' field you'll only use on the controller
echo $this->Form->input('new_password');

Контроллер

// add in your controller `app/Model/User.php@edit()`
// if we have a new password, create key `password` in data
if(!empty($new_password = $this->request->data['User']['new_password']))
  $this->request->data['User']['password'] = $new_password;
else // else, we remove the rules on password
  $this->User->validator()->remove('password');

Хорошо, я наконец получил то, что хотел, вот мой код:

На вашем app/View/Users/edit.ctp вы добавляете поле в свою форму (настраиваемое, не добавляйте его в свою БД)

<?php
// app/View/Users/edit.ctp
echo $this->Form->create('User');
// your other fields
// a 'fake' field you'll only use on the controller
echo $this->Form->input('new_password');

Не меняйте свой app/Model/User.php ; вот мой:

<?php
// app/Model/User.php
App::uses('AuthComponent', 'Controller/Component');

class User extends AppModel {
  public $validate = array(
    // [...] other rules
    'password' => array(
      'passwordLength'=>array(
        'rule' => array('minLength', 8),
        'message' => 'Too short...',
        ),
      'passwordNotBlank'=>array(
        'rule' => 'notBlank',
        'required' => true,
        'allowEmpty' => false,
        'message' => 'A password is required',
        ),
    ),
  );

  public function beforeSave($options = array()) {
    if (!empty($pwd = $this->data[$this->alias]['password']))
      $this->data[$this->alias]['password'] = AuthComponent::password($pwd);

    return true;
  }
}

И на вашем app/Controller/UsersController.php вы используете это:

<?php
public function edit($id = null) {
  $this->User->id = $id;

  if (!$this->User->exists())
    throw new NotFoundException(__('Invalid user'));

  if ($this->request->is('post') || $this->request->is('put')) {
      // IMPORTANT >>>>>>>>>>>
      // if we have a new password, create key `password` in data
    if(!empty($new_password = $this->request->data['User']['new_password']))
      $this->request->data['User']['password'] = $new_password;
    else // else, we remove the rules on password
      $this->User->validator()->remove('password');
      // <<<<<<<<<<<<<<<<<<<<<

      // then we try to save
    if ($this->User->save($this->request->data)) {
      $this->Flash->success(__('The user has been updated'));
      $this->redirect(array('action' => 'index'));
    }
    else
      $this->Flash->warning(__('The user could not be updated.'));
  }
  else {
    $this->request->data = $this->User->read(null, $id);
    unset($this->request->data['User']['password']);
  }
}

С помощью 4 важных строк вы теперь можете установить новый пароль, если это необходимо, или отключить проверку пароля.

Я использовал это для справки http://book.cakephp.org/2.0/en/models/data-validation.html#removing-rules-from-the-set