Please check two things: 1. How much session time you’ve set in the captive portal setting? 2. How much time the client disconnected and reconnected?
If the client disconnected longer than the configured session time, it is normal for the client to be prompted for a token code again.
Another possibility is that the communication latency/delay between the MAX and IC2 is too high. When the client reconnects and the MAX queries IC2 whether the client has signed-in, the reply cannot reach the MAX timely. So the MAX returns the captive portal (CP).
If you think you are not hitting the above two cases, please check if the CP is always returned upon client reconnection only after a 3G/4G uplink reconnection. Clients never see the CP upon reconnection if the uplink connection remains connected.