- handle PAM messages in a separate thread so that when a pam module
        blocks, the cancel button still works (bug 206322)
    - set cursor to busy while waiting on pam module (bug 202276)
    - hide prompt label/entry/unlock button until pam asks the user for input
        (bug 202276)
    - don't assume first pam message will be "Password:" (bug 201858, 202278)