It won't work from dropbox or locally - it should work from a server (probably..).
When the wrong password is entered it doesn't have a 404 page to display, so the address bar still contains 'wrongpassword' - so it thinks the right password was entered.
"I'm here to save your life. But if I'm going to do that, I'll need total uninanonynymity
." Me Myself & Irene
Validate your HTML