do not popup contact online before SIGNED_IN happens
and if SIGNED_IN can happen b4 we get roster, then add a timeout but after SIGNED_IN happens
else just allow them as soon as SIGNED_IN was emitted
yab good to be in .9 (after we freeze) but atm .10