Collect auth requirements for bidirectional source peers and fix follow-up review findings

client/vnc/server/cursor_x11.go

@@ -69,13 +69,16 @@ func (c *xfixesCursor) Cursor() (*image.RGBA, int, int, uint64, error) {
 		return nil, 0, 0, 0, fmt.Errorf("cursor has zero extent")
 	}
 	// Anything past maxCursorDim is discarded by the encoder, so decoding it
-	// would allocate and convert a sprite that can only be thrown away. Keep
-	// showing the last good cursor instead.
+	// would allocate and convert a sprite that can only be thrown away. Report
+	// it as "nothing new" rather than an error: the caller latches a cursor
+	// error for the rest of the session, and an oversized sprite is a property
+	// of the current cursor, not of the source. The next ordinary cursor is
+	// still delivered.
 	if w > maxCursorDim || h > maxCursorDim {
 		if c.lastImg != nil {
 			return c.lastImg, c.lastHotX, c.lastHotY, c.lastSerial, nil
 		}
-		return nil, 0, 0, 0, fmt.Errorf("cursor %dx%d exceeds %d", w, h, maxCursorDim)
+		return nil, 0, 0, 0, nil
 	}
 	if len(reply.CursorImage) < w*h {
 		if c.lastImg != nil {