Move onAuthenticated XAUTHORITY generation to the helper

This avoids it being created as root and then chown'd.

Open for discussion, I know it's not by all means clean code.