General question:We recently switched one of our applications to Application Role security, which mandates (because the backend is SQL2000) that we turn off .NET Connection pooling for the sql ...

ASP.NET sees the session cookie and loads the session (or doesn't, and starts a new one). This is why people recommend serving static, unauthenticated resources like images from a separate domain.

Use custom-built .NET Framework 4.0 classes to connect an ASP.NET Web application to a SQL Server 2012 database.