After attempt to write some code to run a wizard without being logged, I think it is too much complicate. And as it is quite sensible code from the point of view of security, I think it is better to go for a simpler design.
My new proposal is to convert the login method to use a dictionary instead of the current password argument. And the login method will raise a specific exception for any missing parameters. In such case, the client will just request the missing parameter via a pop-up.
I think the design is simpler but still quite flexible. The only disadvantage is that the developer can only request one more parameters at a time.