I've thought about that impersonating password window on OS X a lot too. I like your solution although I'm pretty sure nobody is going to implement that. It only makes sense if we go back to browsers taking over for login, then there could be a uniform approach that could also be outside of the browser controlled window area.