Don't add clients to the broadcast set until they're authenticated. Note

that actual, real auth is not checked yet.

lib/units/device/plugins/vnc/index.js

@@ -110,9 +110,11 @@ module.exports = syrup.serial()
             connState.sentFrameTime = connState.lastFrameTime
           }
 
-          screenStream.broadcastSet.insert(id, {
-            onStart: vncStartListener
-          , onFrame: vncFrameListener
+          conn.on('authenticated', function() {
+            screenStream.broadcastSet.insert(id, {
+              onStart: vncStartListener
+            , onFrame: vncFrameListener
+            })
           })
 
           conn.on('fbupdaterequest', function() {

lib/units/device/plugins/vnc/util/connection.js

@@ -253,6 +253,7 @@ VncConnection.prototype._read = function() {
           }
           debug('client security', this._clientSecurity)
           this._writeSecurityResult(VncConnection.SECURITYRESULT_OK)
+          this.emit('authenticated')
           this._changeState(VncConnection.STATE_NEED_CLIENT_INIT)
         }
         break