So, I can shed a little bit of light on ipad/ipod stuff. The Idevices, as soon as it connects to a wireless connection, try to hit their "success" page. This way, if the device is behind a "captive portal", the user will immediately be prompted for credentials. The success pages are located (on IOS7 at least) at captive.apple.com, ibook.info, airport.us, itools.info, thinkdifferent.us and appleiphonecell.com.
Here is where it gets interesting: If the user chooses to NOT enter the credentials in the captive portal, the device drops the wireless and, depending on the ios version (even small differences. for example 6.1.2 vs 6.1.3) disables the "autojoin" on the "network".
We have firewall rules in place so that no matter who the user is, always allow access to those domains at all times, day or night.
Hope that helps,
Bob