I have worked around the bug (which is still present) with DisplayManager*authorize: false in /etc/X11/xdm/xdm-config.