Well I definitively saw unnatural HTML content overlays in the browser, and the only explanation I can think of is that the wifi hotspot MITM-injected javascript either in .html or .js files as they were downloaded to insert these overlays. Would love to see this proved wrong though :)