1. The error message would not display as expected. I expected something like "Repeat password - Passwords are not equal", but all I got was "com.sun.faces.el.ValueBindingImpl@9af3ee - Passwords are not equal". Fortunately, a quick forum search saved me this time (namely this thread and this one).
2. Both af:inputText components did not behave as expected after validation failure. JSF h:inputSecret has a redisplay attribute, but I didn't notice anything similar for af:inputText. When secret was set to true, something weird happened - after each validation failure the value of both components was initially set to ******, but it disappeared after pressing a key inside the component. After digging for a while I still don't know why the initial value is set to six stars, but I found the function that removes them:
Now that's interesting... Anyway, I tried to get rid of those stars for a long time. The first component that was bound to the password attribute was easier, because binding the component to the backing bean that performs validation and setting the value to null did the trick.
onload="_getElementById(document, 'repeatedUserPassword').value = '';"