This may or may not be helpful, but I ended up side stepping all this, by switching to the Report Viewer control. All the security is handled within the ASP.Net application leaving me free to do my own access control, and report wise it does everything I need.

Obviously this is not the solution for everyone, but avoids most of pain associated with running the full server based solution.