From the same article - "Typically, a wireless SSID (virtual AP) used for guest access in a Remote AP (RAP) is configured in 'bridge' mode (traffic routed locally). However, the Aruba captive portal is hosted on the controller only. Therefore, an user associated to an SSID in bridge mode (forwarding mode) will not be able to reach the captive portal pages hosted on the controller. In order to get around this, the SSID must be set-up in 'split-tunnel' mode. "