WebDAV: Not every 403/Forbidden means wrong credentials
When a contact is dragged&dropped from one address book to another, EDS issues PUT. The server can answer to this with 403 Forbidden: no-uid-conflict precondition. Whether this answer makes sense from the server is a different question. In turn, Evolution asks for new password. This is an endless loop. Evolution shall offer in such cases the possibility to cancel the copy (or perform HTTP MOVE).
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information