"In the specific example discussed below, pool managed resources such as database connections may not sufficiently identify the currently assigned user for tracking and access control purposes." . . . .