Most xRay mods are done by a texture pack. The server cannot stop this...
Yes. That is why I didn't question the xray mod.
Damage has to be done by both sides i think. Without you getting damage done the client dont know you died..
No. All damage is done on server side. The only thing the server is responsible for is telling the client your current health/experience points. All the client is responsible for is sending a respawn packet after your health reaches 0. The client does nothing more than that, all else is is the server's responsibility.
This is why when on Innectis's creative world, you can fall from y coordinate 127.0 to 1.0, and still live without taking fall damage -- the server is responsible for killing you.