Couple of things to check:
Check your post-auth role in your Captive Portal profile; and share with us the following:
show rights <role name>
Also, on CPPM, are you sure you see the authentication hitting a service (in Access Tracker)? If not, confirm that you have changed your AAA Server Group under the Captive Portal Profile. This is often missed and defaults to the internal server group; in this case, authentiation would fail and revert to the "initial role" which would bring back the captive portal page.