It's not especially obvious, and unpleasantly overloaded for the Xnest
case. Typically this gives you a server that looks for its auth data in
the authority file you were using for the running X session, which
generally doesn't have an entry for the display you just started.
All the major dm's, and startx, pass -auth explicitly, so this shouldn't
cause too much upheaval.