Don't add clients to the broadcast set until they're authenticated. Note

that actual, real auth is not checked yet.

lib/units/device/plugins/vnc/util/connection.js

@@ -253,6 +253,7 @@ VncConnection.prototype._read = function() {
           }
           debug('client security', this._clientSecurity)
           this._writeSecurityResult(VncConnection.SECURITYRESULT_OK)
+          this.emit('authenticated')
           this._changeState(VncConnection.STATE_NEED_CLIENT_INIT)
         }
         break