The problem is that you're storing the connection string in an application variable. Application variables are shared by all the application users, so when you set the connection string for a user really you're setting it for all users.
If each user must have its own connection string, then store it in session variables instead of application variables.
Hope that helps.