Turns out this was easy to solve by making the LoginController a @Stateless bean, thereby allowing the container to set up the persistence context correctly:

@Stateless
@Named
public class LoginController {

@Inject
private Identity identity;

@Inject
private FacesContext facesContext;

public void login() {
AuthenticationResult result = identity.login();
if (AuthenticationResult.FAILED.equals(result))

{ facesContext.addMessage( null, new FacesMessage("Authentication was unsuccessful. Please check your username and password " + "before trying again.")); }

}
}

I'll add a task to document transaction control in the reference documentation.