If the application is served on HTTPs, but the captive portal login / logout endpoints are served via HTTP, the browser throws a security exception which is not shown to the user and the loading overlay is displayed indefinitely.

It would be a lot better to show the message of the exception in a browser alert and clear the loading overlay.