You haven't given enough information to anyone to be able to assist you really. I was giving you the most likely cause for what you are seeing based on the very limited information given. You are saying that one person signs in, and then the second one doesn't have to. The usual cause of that is both clients are connected to the same device, and that device just so happens to be a router, like a DLink or Netgear or TPLink, and that device is doing NAT. Because of the way the NAT and routing work the hotspot doesn't see individual clients when they are behind another NAT device, so once someone signs in that is behind that device, everyone connected to that device is authenticated.
You at the very least need to provide your network setup and layout including the kinds of devices that you are using, and configuration information for your network and router for people to assist properly.
Mikrotik does not "provide" layer2 and layer3, those are basic networking concepts of the OSI model. It is most likely a network setup issue and not a router configuration issue.
http://en.wikipedia.org/wiki/OSI_model