Webadmin requires that it be served using a secure server (https:) unless the unsecureok file exists in the etc/webadmin directory(or /etc/courier/webadmin, depending on your installation). You may create the file simply with touch (touch webadmin/unsecureok). If you have the script being served via the SSL-encrypted area on your webserver, you should NOT have the unsecure OK file in your config directory.

Webmin will also not work if the permissions on the password file are group or world accessible (i.e. set it to either 600 or 400).

These are the only two things that I needed to get webadmin to work. I've installed it in several different ways, including RPM, and webadmin wouldn't work unless the above criteria are met. If your webadmin is not 'configured' or arranged properly, it will simply respond as if you entered an invalid password. Its a pretty crappy way of erroring out, but you can at least be assured that it won't work as advertised unless it is configured properly.