Normally captive portals are just keyed on MAC and done through DNS redirect. In this case, just using a browser though the Mango in NAT Lan->Wifi works fine. This is nice because your Mango can then share that authenticated connection amongst many local devices (like my phone).
In rare cases where broadcast is required or even more diabolical network asshattery is afoot, I create a bridge on the Mango Lan<->Wifi with brctl. Of course, then your laptops ethernet MAC is exposed to the Wifi on the other side of your Mango. Even then, I've got a pretty snazzy etables filter to keep that hot mess under control.