we have macros might as well use the

make sure confined users create ~/.ICEauthority.* with proper context
atspi

i took atspi buslauncher out of the equation however later turned out that its xserver client
for now just leave it like this, decide whether to make gui login users xserver clients or to
run atspi buslauncher in its own domain
dbus session clients can read dbus var lib files, and the dbus session bus can read atspiregd config files (atspi runs its own session bus)
gvfs, this is sub-optimal but for the sake of simplicity make gvfsd.common_subject
dbus all sessions client

not all session may run gvfsd, and so in practice gvfsd.common_subject may not need to be dbus all sessions client
gvfs: compromise on flexibility

not sure what is run by session bus and what is run by gvfsd so allow both
gvfsd-fuse runs fusermount
gvfs/fuse: may be a leak