It is bit more complicated. Even GDM creates two different xauthority files. One is given as the "-auth" parameter to the X server and the other is exposed to the user. But in GDM case both of those files are stored under the /run/gdm/... directory.