--enable-xcsecurity crash in 1.5 and beyond

[Jeremy Huddleston]

So, I'm seeing a crash when I build with '--enable-xcsecurity' now.   
This is on the 1.5 branch.  The same xpr/Rootless code worked fine in  
1.4.x, so I believe this is related so some change outside of XQuartz/ 
Rootless.

The call that triggers this from Rootless is harmless as far as I can  
tell:
0x00037198 in RootlessNativeWindowMoved (pWin=0x185a6d40) at  
rootlessWindow.c:142
142         err = dixLookupClient(&pClient, pWin->drawable.id,  
NullClient, DixUnknownAccess);

This NullClient ends up getting passed to SecurityClient() and  
dereferenced there:

#0  0x001b1178 in dixLookupPrivate (privates=0x88, key=0x2c6b68) at  
privates.c:131
#1  0x000954d0 in SecurityClient (pcbl=0x2c6b40, unused=0x0,  
calldata=0xf01849a0) at security.c:900
#2  0x00195078 in _CallCallbacks (pcbl=0x2c6b40, call_data=0xf01849a0)  
at dixutils.c:742
#3  0x0019561c in CallCallbacks (pcbl=0x2c6b40, call_data=0xf01849a0)  
at dixutils.c:876
#4  0x00092ba4 in XaceHook (hook=7) at xace.c:217
#5  0x00193b74 in dixLookupClient (pClient=0xf0184aec, rid=4194312,  
client=0x0, access=0) at dixutils.c:266
#6  0x00037198 in RootlessNativeWindowMoved (pWin=0x185a6d40) at  
rootlessWindow.c:142
...
(gdb) frame 1
#1  0x000954d0 in SecurityClient (pcbl=0x2c6b40, unused=0x0,  
calldata=0xf01849a0) at security.c:900
900         subj = dixLookupPrivate(&rec->client->devPrivates,  
stateKey);
(gdb) print *rec
$3 = {
   client = 0x0,
   target = 0x18574090,
   access_mode = 0,
   status = 0
}

How should this be handled?  Should I be using something other than  
NullClient, or should security be updated to deal with NullClient?

--Jeremy