interesting case The only workaround I find for now - to use
<h:inputSecret value="password" />
<h:commandButton value="Submit" />
just for login form. So it will be still ajax request but it show the dialog in FF for me. But even in this case if I'm pressing "not now" for save password request - it's not fired second time.
That's a known problem, fix is planned to be included into 3.3.3.Final.
I'm using the 3.3.3final version now.
So, it suppose to work with a4j:commandButton just updating the libs or it needs something more?
I've checked this with 3.3.3.Final. While the problem with autocomplete="off" has been fixed, FF still doesn't show prompt for password saving by Ajax. You can try Ilya's workaround or use h:command* components.