We are using click-2-dial links with embeded passwords like this:
.../remote_call.htm?user=123%40domain.com&connect=true&dest=123456789&auth=123%40domain.com%3Asecret
I.e. exactly like in the example at https://vodia.com/doc/click2dial but with connect=true added to avoid the message for "please press 1" each time.
The problem is that very often the SIP phone automatically answers the phone instead of just ringing and waiting for the user to pick it up (of course this only happens for calls that are initiated by click-2-dial links in all other incoming calls the phone behaves normally).