Your switch could certainly be an issue. First confirm that your are using lan base, and not lan lite. See this note from Howon.
https://community.cisco.com/t5/network-access-control/2960x-lan-lite/m-p/3995364/highlight/true#M455212"Lan-Lite doesn't support dACL, pACL, or URL-Redirect so CWA or BYOD will not be possible unless using Auth VLAN feature. Profiling should work as CoA is supported. There are also additional authentication related restrictions with Lan-Lite so not recommended for secure access scenarios."
If you are leveraging lan base already, then consider looking at upgrading to 15.2.7E(ED) as this is the Cisco recommended and "gold star" release. This should rule out any cwa bugs in the 12.x train you are using.
And not the last item, but confirm the switch is learning the IP address of the endpoint via IP device tracking, if not, then the redirect won't work either. This has been a relatively more common issue over the years.
If those items don't sort it out, then we will need to dig in and confirm more about the configuration.
