Did some extra digging:

When I log on to the listener and I start a new query in SSMS. Column contained_availability_group_id in sys.dm_exec_sessions is filled with a GUID.

When I log on...

Both databases are reachable through both logging onto the server as logging on to the listener. When I log on through the listener I get the same results as doing...

Yes, we enabled 'contained database authentication'. Accessing the databases through this contained login is also not a problem. But we are running some queries from time to time to get...

The data in the database is sensitive. So it's not allowed to query it by persons who are not qualified. So if a login can start a query in SSMS...