FortiGate 40F running v6.x

The problem isn't very clear, just wanna confirm that you are using that site as a captive portal but it never loads for the end user? 
There may be additional  domains needed for that page to load properly, you probably can't allow just 'xyz com'.
The easiest way to see this is by pressing F12 in the browser, navigate to the 'Network' tab, refresh the page, and see what requests are failing.

With the old 6.x firmware, mostlikely the problem is caused by NPU offloading. We had some packets drop issues even with 7.0.14. To verify if that's the case, try disabling NPU offload at the outgoing firewall policies with below command:

config firewall policy
  edit x (policy ID)
    set auto-asic-offload disable

  next
end

If this resolves the problem, it's definitely the NPU offloading is having problem. In our case, upgrading 7.2.10 or 7.2.11 solved the problem since those version have newer NPU handing codes.
I recommend upgrading your 40F to 7.2.11 if that's case.

Toshi