Also makes username more private, and password completely private.
As the Success callbacks happen in a scheduled context, if the Update thread is in a stalled state, this loop can generate many unnecessary API requests.
Previously changes to the state were triggering events like Logout, which could get things into a bad state.