There is a way to reset permissions (in 2005) sp_unsetapprole.  It does take some careful coding to make sure it is always called before returning connections to the app_pool, but it is very doable.