Submit user arguments to xinit instead of the xserver.
Hardcode all arguments for the xserver.
Do all exec's with absolute pathnames.
(Prevent users to mess with executables within the search path,
or submit bad arguments to xorg)

Added code to drop suid rights of sxinit;

I also believe it is better having a small suid executable,
which is possible to check for security flaws,
than having a big xserver with countless arguments suid.