You should put both failover interfaces in their own vlan, if you have other devices plugged into the switch.

I've seen this happen with certain inspect statements, such as smtp inspect.

You don't need a serial cable with ASA's. I would recommend that you put a switch in between the failover connections. If you loose an ASA both e0/3 interfaces will go down and you may run into issues.

If your talking about identifying users over vpn I believe that you can use the Radius agent and bind it with your ACS.

Assuming all Internet traffic is split tunneled for vpn.Here's an example below the websense server is on the inside interface and it's ip is 10.255.40.164.url-server (inside) host 10.255.40.164 timeout 30 protocol TCP version 4The following command ...