My last message about this can be found here: 
http://m0n0.ch/wall/list/?action=show_msg&actionargs[]=104&actionargs[]=89 
and a fairly verbose description of what I've found out since that last 
message can be found here: http://www.burlco.org/captive/ (includes tcpdump)

In a nutshell, m0n0wall seems to be sending spurious RST packets to the 
client after they authenticate to the captive portal.  Depending on the 
timing of the RST packet, this sometimes results in truncation of the 
page that m0n0wall sends in order to show the logout popup and redirect 
the browser to the desired web site.  I've seen this behaviour in 
m0n0wall 1.1, 1.2b1, and 1.2b2.

I hope nobody thinks I'm whining about this, I'm just documenting what I 
find as I try to troubleshoot it.  Of course if it helps someone else 
fix it, all the better :-)