Yep, that's the story. Also, if I assign another role (so they're under public and setupadmin, or public and serveradmin), they can't log in.

The default db is master for all roles and live user logins.

Thanks