I hate to answer my own post, but at least it's really a bug in the application:
In case of failed login the LoginAction should not return "login" as an outcome, because that would be rendered as a new view and the context is lost.
Instead it should return null to re-render the current view.
The trouble is that there is currently a bug in MyFaces/Facelets integration that causes problems with null outcomes.
But I can easily fix the problem using the Seam facesMessages component.
fixed in cvs