Hello,
to disable the host based access control, I've always been starting X server 
as follows:
D:\cygwin\bin\run.exe /usr/bin/bash.exe -l -c "/usr/bin/startxwin.exe -- -ac"
Which matches the description from here by the way: 
http://x.cygwin.com/docs/faq/cygwin-x-faq.html#q-command-line-args

However since some recent update (most likely since updating to 
run-1.3.2-1.tar.xz or later - see below), the -ac server argument stopped to 
have any effect.
In XWin log I can see it starts as follows:
XWin was started with the following command line:

X :0 -multiwindow


Whereas previously it was (as one would expect):
XWin was started with the following command line:

X -ac :0 -multiwindow


While testing launching the X server the same way from Windows command line 
and from the Cygwin shell I found out that the problem always occurs when 
there's run.exe involved (e.g. executing /usr/bin/bash.exe -l -c 
"/usr/bin/startxwin.exe -- -ac" from the Cygwin shell works as expected).

Did the behavior change so it has to be started with additional server 
parameters differently now? If so, it isn't documented correctly. If not, it's
 most likely a bug.

Running Cygwin x86_64, currently up to date, see attached cygcheck.out for 
more information.

Best regards,
Peter