The only time that I thing (note the I) is legit to restrict pasting is on an email confirmation field (only on confirmation).

Nowadays your email is more important than your password, and an email is usually rather simple to type.