To see the code you have to checkout CVS module "jbosspool" with branch "Branch_2_4".
1. You can almost certainly get rid of the npe by setting blocking= true and a blocking timeout if you wish.
2. I'm not very familiar with the XADataSourceLoader login code. The pools actually support a per-user pooling strategy, although per-factory is the default. I'm not sure if you can set this parameter in XADataSourceLoader.
2.5 Using jboss 3 and ConnectionFactoryLoaders and possibly jboss2.4.4 and ConnectionFactoryLoaders you definitely can set the pool to per-user. I'm not sure how much of this will work if you use application-managed signon, but I suggest you use h2ee security to keep track of who your users are. You will then be able to easily write a new PrincipalMapping class that takes the users name and password, makes a Subject, and gives it to the driver for login, and uses it as a pool key.
Note that if you have many users.... you should set the idle timeout short so you don't have zillions of connections for people who are long gone and far away.