PiP protocol addition...!?

Password prompts are a complex example. Yes, I want them to forcefully keep the focus, but no, I don't want them to steal focus either because I might be typing something into another window and hit the wrong key at just the wrong time when it pops up and waste a password attempt at best or have some auth system cache wrong credentials or lock me out immediately at worst.

Both of those could be solved by just not allowing focus stealing at all and only allowing the user to manually switch focus to a new window.