Android phones, apps and tablets

VPN routes requests to your own network. Login page is local to the AP, not routable from your network.

AP refuses to route traffic for clients who haven't got a login token, hence you have no VPN connection anyway.

Maybe I'm using the wrong phrase, by VPN, I mean a VPN tunnel. could be SSH, but you'd still have the situation described, so would need an exemption for the tunnel for public-wifi-requiring-login.

But it's a public access point, no? I'm not thinking in terms of point-to-point VPN, I'm thinking of my use case with OpenVPN, with the exit point somewhere else in the world, exiting (no longer encrypted) and hitting a public web page - the access page. So the whole route is not encrypted but no one in the room will be stealing your shit locally.