Can the user get to the page by typing the controller ip address?
Yes.
Do all vlans have an IP address on the controller?
Yes.
The initial role has this ACL, but the default role hasn't. Do I Need this ACL after logon?
ip access-list session captiveportal
user alias controller svc-https dst-nat 8081
user any svc-http dst-nat 8080
user any svc-https dst-nat 8081
user any svc-http-proxy1 dst-nat 8088
user any svc-http-proxy2 dst-nat 8088
user any svc-http-proxy3 dst-nat 8088