The trick is to do the following:
/ip hotspot profile set hsprof1 dns-name=""
/ip hotspot walled-garden
add action=allow comment="" disabled=no dst-host=www.apple.com path=/library/test/success.html
For some reason the iPhone and iPad won't resolve the dns-name of the hot spot properly, so don't set it and it will use the IP instead.
The next trick is to allow http://www.apple.com/library/test/success.html
in the walled-garden. If IOS can't see that URL, it pops up the annoying login screen. The user can then go run a browser on the device and will be presented with the hotspot login screen.
This is of course a workaround. The proper way to do it is to figure out what the little login popup screen wants to see as a signal that the user was authenticated, but I haven't been able to figure that one out yet.