3 issues.....

1)
When I enable kerberos, and a user logs in, from a machine, which is in
the kerberos included IP address scope, and that machine is not joined to
a domain, the user is promted with what looks like an ntlm login login
dialogue.
Can we get around this somehow?

2)
When the user then cancels that prompt, a very ugly login page appears.
It is not possible to submit username and password on that login page.
What is wrong here? (I took a picture of it) http://www.pleasuresquad.dk/
gfx/nam-login-ugly.png

3)
When a user uses firefox, the above happens. Even from a domain joined
machine.
Does anyone know how to get firefox to do kerbers?