The vWLAN is the web server for captive portal authentication. The AP does not store the splash page but rather redirects the client to vWLAN. You could use an AP traffic capture (wired type on the NAC interface) to actually see the process. You would look for HTTP Get requests and 302 Found responses. For more information on traffic captures, check out our vWLAN and BSAP Traffic Capture Guide.