Move creating XAuth token into after we've switched UID

Otherwise ~/.Xauthority ends up owned by root