We require the command line tools xauth and xhost for the session to function correctly. Currently, we try to make sure they are available by having tl-setup install them. It would be more robust if we included these tools ourselves, like we do for xprop. These are fairly small applications, so it shouldn't be much hassle. This might become more crucial as distributions move more away from X11 in favour of Wayland.
xprop currently lives in vsm/, as that's where the current users are. xauth is also currently only used by things in vsm/. xhost, on the other hand, is used by scripts in tlmisc/. Since these are fairly general commands, perhaps it's better to gather them in a single place. These are for configuring X11, so placing them next to our X server (i.e. vnc/) probably makes most sense.