Thanks Tim!
Is there anything else required for the pre-auth role in Instant that the below for this to work?
wlan walled-garden
white-list "*.ggpht.com"
white-list "android.clients.google.com "
white-list "*.gvt1.com"
white-list "*.play.googleapis.com"
white-list "www.googleapis.com"
wlan access-rule pre-auth
captive-portal external profile clearpass
rule any any match any any any deny