Mike,
What's happening is a setting from the v4.06 web.config didn't make it to the v4.08 web.config.

Look for the "<machineKey validationKey="dsghsdhsdthsdth" decryptionKey="sdghsdthseth" decryption="3DES" validation="SHA1" />" line in your OLD web.config.

You need to copy over your validationKey and decryptionKey values.

BUT, the problem you now have is that since you have different keys (referenced above) on your NEW install, if you revise the keys to match your OLD install, you lock out the new users and let in the old users. If you leave it alone, you lock out the old users and let in the new users.

Your host should have pointed this out to you!

But since they didn't, your best option is probably to go back to the OLD val and decryption keys, get the majority of users satisifeid with valid logins, and email or notify all new users to reset their password, or re-register their account.

Eric