WebService Security

I'm not very sure this is actually a bug, it can be either way.

The point is, that if you requested the spreadsheet list, and you were able to get it (because of your WebService had no password), then after you set a password, even if they don't match, there is no point in deleting the list. You already accessed and saw that information!

Said that, if you changed your webService URL, then it makes sense to clear that list because it may be referencing to a different google drive. So, it will show old/invalid names.
Either way, just to be sure, I will clear the list everytime you click the "Refresh" button, that way if it fails and shows "Wrong Password", you get even more confirmation that failed when you see the list empty.

Thanks,
Frank

Thanks for reporting this!
I added a fix to 2.8.7b4