The server, on receiving a request from a non-authenticated user, and without having received an acceptance, presents a TOU page that doesn't itself require authentication; records the activation of an Accept button; and then displays the usual login prompt. Perhaps this calls for using a .NET http handler (this is a .NET website) or something like that.
The server, instead of showing a dialog with a name field, a password field, and an OK button, shows a dialog with a name field, a password field, the text of the TOU, and an Accept button.
I'm not sure that either is possible, but I hate the idea of having to restructure our website to use forms authentication just for this. Is there a way to meet the requirement without replacing our existing authentication infrastructure?