Did you ever figure out the cause of the dual prompt?

I'm not sure if it can be considered a bug or not. When you think about it going to WindowsSignin is already secure in the sense that it pulls the user's "LOGON_USER" from the ServerVariables and that's it. The password is never passed through the procedures called by WindowsSignin.aspx.

Under automatic login the password isn't passed. All that's checked is (this is further into code that'd called from WindowsSignin and is done in communication between the webserver and the domaincontroller) whether the user is a member of the domain. If yes then the user is logged in. If no then you get the Windows IIS popup asking you to login. The reason the password isn't required is that if the LOGON_USER servervariable is a domain user then they are already authenticated to domain so they don't need to be authenticated again. If you look at this link it'll show you what information is passed. Note that Auth_Password isn't passed in our case because we're using Windows Authentication and not Basic Authentication to the IIS server.