Configuring AD authentication for wireless clients

Hi,

I've seen all the great help here, so I figured I'll pose my question.
Hopefully it's an easy one.

I've got a network for a local high school running Windows Server 2003
with each student having an account on the system. I want to add a
wireless AP to the network to allow wireless internet in the library.
However, I would like students to have to login before they gain access
to the internet and prevent them from accessing anything else, like
fileshares.

Since some kids have Macs and other PCs I would like the whole
authentication process to occur in their web browser, kind of like
Starbucks has. How can I set this up? Do I need a special access
point or will any work? Does Server 2003 have the software to handle
this or is it something additional?

Thanks,
Phil