Turns out the Sony PRST1 uses the Android web browser. The problem of an authorization failure is a known bug on Android. Sony appears not to have fixed it, although it's been reported on the Android forums for more than 2 years now. I guess I have to just live with it.
Options are to do auth by IP address, if that doesn't change very often. Another possibility is to authorize by browser type. The PRST1 reports itself as EBRD1101 in the user-agent field.
If anyone else is looking for the details, they can be found here:
http://code.google.com/p/android/issues/detail?id=1353