> The current solution is just the simplest thing I could do with the minimal amount of code.

Yes, and it works ;)

> I don't think this should be a text input in the options page, because there is some state hidden behind the input. I think it would be better to have something to guide you though the authorization process.

Then perhaps pressing Log In button should pop up a dialog, with explanation
about the process, and the authorization code input field.
Imho, it should also (optionally?) display the url sent to the browser in case of Picard fails to open the browser automatically (for manual cut'n'paste).
Can you describe each step ?

> The password dialog would be only used for non-MB sites.

In which cases does this happen ?