Clarification regarding x-authentication

["Glen Matthews" <glen%montreal.hcl.com@localhost>]

Hi,

  this is a request for a clarification. 

  I'm looking at section 4.3.1 in the connection protocol - the comment
regarding Requesting X11 Forwarding is that: "It is recommended that the
authentication cookie that is sent be a fake, random cookie, and that the
cookie is checked and replaced by the real cookie when a connection request
is received."

  who should check? The ssh client or the server? And should the ssh client
delve into the first x11 protocol packet for the cookie? I see where it is,
but is that how the authentication should be carried out?

Glen Matthews
Hummingbird