Make the keychain lookup's username argument optional (use system's user by default) and prompt for the password if it hasn't been set in the keychain yet.