SQLState configuration

[Jeff]

We're attempting to use SQLState for our Session state on our web
app's.

First, what rights do I have to give to the user to be able to access
the ASPState DB correctly? I've read a few things that suggest the
user needs to have dbo rights to TempDB also.. is this correct? What
other rights does it need? Most of the samples out there show using
userid=sa ... obviously that's not a great solution for a production
system..

Second, are there any ways to secure/hide the UserID/PWD in the
SQLState's connection string?

thanks

jeffpriz