A retail company deploys 802.1X on all wired switch ports for employee laptops. However, several older shared kiosk PCs lack a working supplicant and cannot pass certificate or credential-based EAP authentication. The security team wants these kiosks to still receive limited network access only after a user manually enters valid Active Directory credentials in a browser-based login page, without permanently exempting the ports. Which authentication mechanism should be configured as the fallback for these ports?