diff --git a/mozilla/security/nss/lib/softoken/pkcs11.c b/mozilla/security/nss/lib/softoken/pkcs11.c
index a8af7b315d7..f4d7260402c 100644
--- a/mozilla/security/nss/lib/softoken/pkcs11.c
+++ b/mozilla/security/nss/lib/softoken/pkcs11.c
@@ -563,7 +563,12 @@ sftk_hasNullPassword(SFTKSlot *slot, SFTKDBHandle *keydb)
    
     pwenabled = PR_FALSE;
     if (sftkdb_HasPasswordSet(keydb) == SECSuccess) {
-	return (sftkdb_CheckPassword(slot, keydb, "") == SECSuccess);
+	PRBool tokenRemoved = PR_FALSE;
+    	SECStatus rv = sftkdb_CheckPassword(keydb, "", &tokenRemoved);
+	if (tokenRemoved) {
+	    sftk_CloseAllSessions(slot);
+	}
+	return (rv  == SECSuccess);
     }
 
     return pwenabled;
@@ -2997,6 +3002,7 @@ CK_RV NSC_InitPIN(CK_SESSION_HANDLE hSession,
     char newPinStr[SFTK_MAX_PIN+1];
     SECStatus rv;
     CK_RV crv = CKR_SESSION_HANDLE_INVALID;
+    PRBool tokenRemoved = PR_FALSE;
 
     CHECK_FORK();
     
@@ -3047,7 +3053,10 @@ CK_RV NSC_InitPIN(CK_SESSION_HANDLE hSession,
     /* build the hashed pins which we pass around */
 
     /* change the data base */
-    rv = sftkdb_ChangePassword(slot, handle, NULL, newPinStr);
+    rv = sftkdb_ChangePassword(handle, NULL, newPinStr, &tokenRemoved);
+    if (tokenRemoved) {
+	sftk_CloseAllSessions(slot);
+    }
     sftk_freeDB(handle);
     handle = NULL;
 
@@ -3080,6 +3089,7 @@ CK_RV NSC_SetPIN(CK_SESSION_HANDLE hSession, CK_CHAR_PTR pOldPin,
     char newPinStr[SFTK_MAX_PIN+1],oldPinStr[SFTK_MAX_PIN+1];
     SECStatus rv;
     CK_RV crv = CKR_SESSION_HANDLE_INVALID;
+    PRBool tokenRemoved = PR_FALSE;
 
     CHECK_FORK();
     
@@ -3126,7 +3136,10 @@ CK_RV NSC_SetPIN(CK_SESSION_HANDLE hSession, CK_CHAR_PTR pOldPin,
 
     /* change the data base password */
     PR_Lock(slot->pwCheckLock);
-    rv = sftkdb_ChangePassword(slot, handle, oldPinStr, newPinStr);
+    rv = sftkdb_ChangePassword(handle, oldPinStr, newPinStr, &tokenRemoved);
+    if (tokenRemoved) {
+	sftk_CloseAllSessions(slot);
+    }
     sftk_freeDB(handle);
     handle = NULL;
     if ((rv != SECSuccess) && (slot->slotID == FIPS_SLOT_ID)) {
@@ -3296,6 +3309,7 @@ CK_RV NSC_Login(CK_SESSION_HANDLE hSession, CK_USER_TYPE userType,
     SECStatus rv;
     CK_RV crv;
     char pinStr[SFTK_MAX_PIN+1];
+    PRBool tokenRemoved = PR_FALSE;
 
     CHECK_FORK();
 
@@ -3372,7 +3386,10 @@ CK_RV NSC_Login(CK_SESSION_HANDLE hSession, CK_USER_TYPE userType,
 
     /* build the hashed pins which we pass around */
     PR_Lock(slot->pwCheckLock);
-    rv = sftkdb_CheckPassword(slot,handle,pinStr);
+    rv = sftkdb_CheckPassword(handle,pinStr, &tokenRemoved);
+    if (tokenRemoved) {
+	sftk_CloseAllSessions(slot);
+    }
     if ((rv != SECSuccess) && (slot->slotID == FIPS_SLOT_ID)) {
 	PR_Sleep(loginWaitTime);
     }
diff --git a/mozilla/security/nss/lib/softoken/sftkdb.c b/mozilla/security/nss/lib/softoken/sftkdb.c
index 3714a8a98c6..c17ef858f6a 100644
--- a/mozilla/security/nss/lib/softoken/sftkdb.c
+++ b/mozilla/security/nss/lib/softoken/sftkdb.c
@@ -2375,6 +2375,7 @@ sftk_DBInit(const char *configdir, const char *certPrefix,
 		updateCert->app_private = (*certDB);
 	    }
 	    if (*keyDB) {
+		PRBool tokenRemoved = PR_FALSE;
 		(*keyDB)->update = updateKey;
 		(*keyDB)->updateID = updateID && *updateID ? 
 					PORT_Strdup(updateID) : NULL;
@@ -2385,7 +2386,7 @@ sftk_DBInit(const char *configdir, const char *certPrefix,
 			 PR_TRUE : PR_FALSE;
 		/* if the password on the key db is NULL, kick off our update
 		 * chain of events */
-		sftkdb_CheckPassword(NULL, (*keyDB), "");
+		sftkdb_CheckPassword((*keyDB), "", &tokenRemoved);
 	    } else {
 		/* we don't have a key DB, update the certificate DB now */
 		sftkdb_Update(*certDB, NULL);
diff --git a/mozilla/security/nss/lib/softoken/sftkdb.h b/mozilla/security/nss/lib/softoken/sftkdb.h
index 0efca393050..14113fb3dcd 100644
--- a/mozilla/security/nss/lib/softoken/sftkdb.h
+++ b/mozilla/security/nss/lib/softoken/sftkdb.h
@@ -71,12 +71,14 @@ SECStatus sftkdb_AddSecmodDB(SDBType dbType, const char *appName,
 /* keydb functions */
 
 SECStatus sftkdb_PWIsInitialized(SFTKDBHandle *keydb);
-SECStatus sftkdb_CheckPassword(SFTKSlot * slot, SFTKDBHandle *keydb, const char *pw);
+SECStatus sftkdb_CheckPassword(SFTKDBHandle *keydb, const char *pw,
+			       PRBool *tokenRemoved);
 SECStatus sftkdb_PWCached(SFTKDBHandle *keydb);
 SECStatus sftkdb_HasPasswordSet(SFTKDBHandle *keydb);
 SECStatus sftkdb_ResetKeyDB(SFTKDBHandle *keydb);
-SECStatus sftkdb_ChangePassword(SFTKSlot *slot, SFTKDBHandle *keydb, 
-				char *oldPin, char *newPin);
+SECStatus sftkdb_ChangePassword(SFTKDBHandle *keydb, 
+				char *oldPin, char *newPin,
+				PRBool *tokenRemoved);
 SECStatus sftkdb_ClearPassword(SFTKDBHandle *keydb);
 PRBool sftkdb_InUpdateMerge(SFTKDBHandle *keydb);
 PRBool sftkdb_NeedUpdateDBPassword(SFTKDBHandle *keydb);
diff --git a/mozilla/security/nss/lib/softoken/sftkpwd.c b/mozilla/security/nss/lib/softoken/sftkpwd.c
index 9446deac90a..7198596a60b 100644
--- a/mozilla/security/nss/lib/softoken/sftkpwd.c
+++ b/mozilla/security/nss/lib/softoken/sftkpwd.c
@@ -696,7 +696,7 @@ sftkdb_HasPasswordSet(SFTKDBHandle *keydb)
  * check if the supplied password is valid
  */
 SECStatus  
-sftkdb_CheckPassword(SFTKSlot *slot, SFTKDBHandle *keydb, const char *pw)
+sftkdb_CheckPassword(SFTKDBHandle *keydb, const char *pw, PRBool *tokenRemoved)
 {
     SECStatus rv;
     SECItem salt, value;
@@ -789,12 +789,8 @@ sftkdb_CheckPassword(SFTKSlot *slot, SFTKDBHandle *keydb, const char *pw)
 	    }
 
 	    /* Simulate a token removal -- we need to do this any
-             * any case at this point so the token name is correct. NOTE: if 
-	     * slot is NULL, then we were called from the database init code,
-	     * there are no sessions, so there is no need to close them. */
-	    if (slot) {
-		sftk_CloseAllSessions(slot);
-	    }
+             * any case at this point so the token name is correct. */
+	    *tokenRemoved = PR_TRUE;
 
 	    /* 
 	     * OK, we got the update DB password, see if we need a password
@@ -813,13 +809,13 @@ sftkdb_CheckPassword(SFTKSlot *slot, SFTKDBHandle *keydb, const char *pw)
 		 *  because we are making this call from a NeedUpdateDBPassword
 		 *  block and we've already set that update password at this
 		 *  point.  */
-		rv = sftkdb_CheckPassword(slot, keydb, pw);
+		rv = sftkdb_CheckPassword(keydb, pw, tokenRemoved);
 		if (rv == SECSuccess) {
 		    /* source and target databases have the same password, we 
 		     * are good to go */
 		    goto done;
 		}
-		sftkdb_CheckPassword(slot, keydb, "");
+		sftkdb_CheckPassword(keydb, "", tokenRemoved);
 
 		/*
 		 * Important 'NULL' code here. At this point either we 
@@ -1165,8 +1161,8 @@ sftkdb_convertObjects(SFTKDBHandle *handle, CK_ATTRIBUTE *template,
  * change the database password.
  */
 SECStatus
-sftkdb_ChangePassword(SFTKSlot *slot, SFTKDBHandle *keydb, 
-                      char *oldPin, char *newPin)
+sftkdb_ChangePassword(SFTKDBHandle *keydb, 
+                      char *oldPin, char *newPin, PRBool *tokenRemoved)
 {
     SECStatus rv = SECSuccess;
     SECItem plainText;
@@ -1202,7 +1198,7 @@ sftkdb_ChangePassword(SFTKSlot *slot, SFTKDBHandle *keydb,
     value.len = sizeof(valueData);
     crv = (*db->sdb_GetMetaData)(db, "password", &salt, &value);
     if (crv == CKR_OK) {
-	rv = sftkdb_CheckPassword(slot, keydb, oldPin);
+	rv = sftkdb_CheckPassword(keydb, oldPin, tokenRemoved);
 	if (rv == SECFailure) {
 	    goto loser;
 	}