--- a/mail/components/cloudfile/nsYouSendIt.js
+++ b/mail/components/cloudfile/nsYouSendIt.js
@@ -258,26 +258,26 @@ nsYouSendIt.prototype = {
     this.log.info("getting user info");
     let args = "?email=" + this._userName;
 
     let req = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"]
                 .createInstance(Ci.nsIXMLHttpRequest);
     req.open("GET", gServerUrl + kUserInfoPath + args, true);
 
     req.onload = function() {
-      if (req.status >= 200 && req.status < 400) {
+      if (req.status >= 200 && req.status <= 400) {
         this.log.info("request status = " + req.status +
                       " response = " + req.responseText);
         let docResponse = JSON.parse(req.responseText);
         this.log.info("user info response parsed = " + docResponse);
         if (docResponse.errorStatus)
           this.log.info("error status = " + docResponse.errorStatus.code);
 
         if (docResponse.errorStatus && docResponse.errorStatus.code > 200) {
-          if (docResponse.errorStatus.code > 400) {
+          if (docResponse.errorStatus.code >= 400) {
             // Our token has gone stale
             this.log.info("Our token has gone stale - requesting a new one.");
 
             let retryGetUserInfo = function() {
               this._getUserInfo(successCallback, failureCallback);
             }.bind(this);
 
             this._handleStaleToken(retryGetUserInfo, failureCallback);
@@ -602,16 +602,26 @@ nsYouSendIt.prototype = {
                                     authPrompter.SAVE_PASSWORD_PERMANENTLY,
                                     password))
       return password.value;
 
     return "";
   },
 
   /**
+   * Clears any saved YouSendIt passwords for this instance's account.
+   */
+  clearPassword: function nsYouSendIt_clearPassword() {
+    let logins = Services.logins.findLogins({}, gServerUrl, null, gServerUrl);
+    for each (let loginInfo in logins)
+      if (loginInfo.username == this._userName)
+        Services.logins.removeLogin(loginInfo);
+  },
+
+  /**
    * Attempt to log on and get the auth token for this YouSendIt account.
    *
    * @param successCallback the callback to be fired if logging on is successful
    * @param failureCallback the callback to be fired if loggong on fails
    * @aparam aWithUI a boolean for whether or not we should prompt for a password
    *                 if no auth token is currently stored.
    */
   logon: function nsYouSendIt_login(successCallback, failureCallback, aWithUI) {
@@ -637,23 +647,25 @@ nsYouSendIt.prototype = {
         this.log.info("login response parsed = " + docResponse);
         this._cachedAuthToken = docResponse.authToken;
         this.log.info("authToken = " + this._cachedAuthToken);
         if (this._cachedAuthToken) {
           this._loggedIn = true;
           successCallback();
         }
         else {
+          this.clearPassword();
           this._loggedIn = false;
           this._lastErrorText = docResponse.errorStatus.message;
           this._lastErrorStatus = docResponse.errorStatus.code;
           failureCallback();
         }
       }
       else {
+        this.clearPassword();
         failureCallback();
       }
     }.bind(this);
     req.setRequestHeader("X-Api-Key", kApiKey);
     req.setRequestHeader("Date", curDate);
     req.setRequestHeader("Accept", "application/json");
     req.send();
     this.log.info("Login information sent!");