To clarify Ryan's comment a bit, perhaps, what you are seeing is the ID of the composite component itself, which is a NamingContainer, being applied to all of the child components. Since the form has prependId set to false, it is not prepended, but the parent NamingContainer's is, thus you get ""j_idt9:j_password". If you give your composite component usage an ID on the using page, you'll see j_idt9 changed to the explicit ID you add.
[Message sent by forum member 'jdlee']
http://forums.java.net/jive/thread.jspa?messageID=395543