Xykon is the caster of the cloister though, so he might have been able to give Redcloak a bypass command. One could argue that only specific spells with a given ritual can get through given comic 532, but I think its likely that Dorukan still put in a password for simplicity's sake.

As for Xykon getting said password, it might be set at casting. Or it was in the box of wheaties with the headband