There is no security result for the "none" authentication until RFB 3.8. This got broken by mistake in 5671072.
5671072