I misunderstood pjsip's concept of endpoints/AoRs. Multiple devices can be bound to a single endpoint, which in turn can have multiple AoRs. So the password should be bound to an Extension, not a Phone.
