DHCP relay should work on a IPSEC tunnel, not easy-peasy, but doable, some old reference:
http://forum.mikrotik.com/t/dhcp-realy-over-ipsec-tunnel/37077/1
Then, you might need some scripting (possibly even a Netwatch might be able to trigger the script) that switches to the local DHCP server.
The problem might be that the local DHCP server will have no idea of which addresses have already been assigned to the local devices from the remote DHCP server (and viceversa when connection is re-established the remote one won’t have any idea of which addresses have already been assigned), so you might need to divide the network, i.e. if using a /24 have 0-127 on the remote pool and 128-254 on local pool or use a /23 and have pools remote x.x.0.x and local x.x.1.x.
No idea about the DHCP authentication you imagine, maybe something like this?
http://forum.mikrotik.com/t/dhcp-local-database-authentication-without-radius-server/64948/1
but AFAICU no easy way to “authorize” the device(s), there is hotspot, which is a sort of local captive portal:
https://help.mikrotik.com/docs/pages/viewpage.action?pageId=56459266