LoginWindow: move sleep to authorize(), don't block UI