I'm not sure how well this is supported on 2.4.x. You need to supply a user and password so the XADataSourceLoader can check that it can get a connection when it starts (or you can comment out the line in which it does this).
After that, you can get connections using ds.getConnection(user, pw);. What I don't know is how well connections with different users are distinguished by the pool. There are settings in the pool that tell it something about what to pay attention to, but I'm not sure where they are set or to what.