container « Component « JSF Q&A

1. Acquire full prefix for a component clientId inside naming containers with JSF 2.0

I am updating a component via AJAX in JSF:

    <h:outputLink>Click me
        <f:ajax event="click" render=":messages" />

<h:messages id="messages" globalOnly="true" ...

2. Protected URLs leaking unprotected components of the webapge to unauthenticated users

I believe implementing security for a JSF application through <login-config>+<security-constraint>+ <security-role> & through use of <filter> are two different ways !? Are they ? I tried implementing security through the first method ...