Currently the only secure way is to start a second X screen with another uid.