The AD Credential thing is interesting. If there are matching AD credentials at the instance level, the authentication takes place there first, which makes sense. So if you move a partially contained database to a server that has a matching login, the login isn't contained.

Not a big deal, but interesting.