Michael says X needs stronger, hostname-independent, authentication.

xhost +SI:localuser:foo:

daniels@ephemera:~% xhost +SI:localuser:nobody
localuser:nobody being added to access control list
daniels@ephemera:~% sudo -u nobody xdpyinfo
name of display: :0.0
version number: 11.0
vendor string: The X.Org Foundation
[...]

This was all part of the ServerInterpreted auth scheme, which I think Sun did the work on. So you're free to concoct arbitrary schemes involving SELinux, and just implement them in the server you're intersted in.

Corey writes that he's glad GNOME gets it, based on Jono Bacon's O'Reilly article on how Linux sound applications need simplicity. Corey, if you want to contact Jono to chat about his observations some more, you can email him: jono@kde.org.