Although it would make sense for this to be true, after all access control is supposed to be what xauth does, it doesn't work like this.