I've been doing some work with auth2 (adding GSS-API) and I noticed that the per connection information being malloc'ed (auth2.c:471) isn't freed. I'm not sure where the best place to free this should be. It could be freed whenever AuthQuit is called but a misbehaving client might never call that RPC - the best solution would be to wait for a specified time and then just free connection info. Does this make any sense or am I off here?
-M.
