The sshrc code suggested at the bottom of sshd(8) is unsafe,
in that it passes around the xauth key as an argument to
xauth -- while xauth is running, the key is, on most systems,
visible to other users on the same machine.  A more secure
way to pass the key is something like:

  echo add $DISPLAY $proto $cookie | xauth -q

which, in /bin/sh on most systems, uses the built-in echo
command.

While this isn't strictly a bug, it seems poor to suggest
code that exposes the xauth key.  Incidentally, it may also
be nice to use "xauth -q" instead of just "xauth", since the
same manpage also warns that sshrc shouldn't output anything
to stdout, which "xauth" does.