On the machine in question, the host name is changed after lightdm is started.  This might have X reject connections from processes (esp. startxfce) started with a different host name than the one X itself was started with.

Solution would be: don't change the host name after lightdm was started, or, start lightdm only after the host name is settled.

Cf. https://github.com/canonical/lightdm/issues/291

Reproducible: Always

Steps to Reproduce:
1. Boot machine
2. Try to login
3.
Actual Results:  
Login kind of succeeds, but no session is started and the login screen is shown again.  .xsession-errors mentions X communication errors.

A second (and every further) login attempt succeeds.

Expected Results:  
Login succeeds on the first attempt.

Adding

After=systemd-hostnamed.service

to lightdm.service solves the problem.