mir_connection_create_surface callback is sometimes called twice on error

I've just run into some fun behaviour. In mir_surface.cpp, in the surface constructor, if:

server.create_surface(0, &message, &surface, gp::NewCallback(this, &MirSurface::created, callback, context));

throws (such as if the RPC mechanism detects a connection break) then the created callback is called on the partially constructed MirSurface that's just about to be destructed. mir_connection_create_surface catches this exception and then calls the callback *again*, with an newly constructed error MirSurface.

This is likely to confuse API users :)