Profile unlock should always use session restore, regardless of system preference.

chrome/browser/ui/webui/signin/user_manager_screen_handler.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/signin/user_manager_screen_handler.h"
 
 #include "base/bind.h"
 #include "base/prefs/pref_service.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/value_conversions.h"
@@ skipping 678 matching lines @@
 
 void UserManagerScreenHandler::ReportAuthenticationResult(
     bool success,
     ProfileMetrics::ProfileAuth auth) {
   ProfileMetrics::LogProfileAuthResult(auth);
   password_attempt_.clear();
 
   if (success) {
     ProfileInfoCache& info_cache =
         g_browser_process->profile_manager()->GetProfileInfoCache();
-    info_cache.SetProfileSigninRequiredAtIndex(
-        authenticating_profile_index_, false);
     base::FilePath path = info_cache.GetPathOfProfileAtIndex(
         authenticating_profile_index_);
     profiles::SwitchToProfile(
         path,
         desktop_type_,
         true,
         base::Bind(&UserManagerScreenHandler::OnSwitchToProfileComplete,
                    weak_ptr_factory_.GetWeakPtr()),
         ProfileMetrics::SWITCH_PROFILE_UNLOCK);
   } else {
     web_ui()->CallJavascriptFunction(
         "cr.ui.Oobe.showSignInError",
         base::FundamentalValue(0),
         base::StringValue(l10n_util::GetStringUTF8(
             auth == ProfileMetrics::AUTH_FAILED_OFFLINE ?
                 IDS_LOGIN_ERROR_AUTHENTICATING_OFFLINE :
                 IDS_LOGIN_ERROR_AUTHENTICATING)),
         base::StringValue(""),
         base::FundamentalValue(0));
   }
 }
 
 void UserManagerScreenHandler::OnBrowserWindowReady(Browser* browser) {
   DCHECK(browser);
   DCHECK(browser->window());
+
+  // Unlock the profile after browser opens so startup can read the lock bit.

[bcwhite, 2014/10/30 19:39:44]

Can you add something like "any authentication must have been successful to
reach this point"?

+  ProfileInfoCache& info_cache =
+      g_browser_process->profile_manager()->GetProfileInfoCache();
+  size_t index = info_cache.GetIndexOfProfileWithPath(
+      browser->profile()->GetPath());
+  info_cache.SetProfileSigninRequiredAtIndex(index, false);
+
   if (url_hash_ == profiles::kUserManagerSelectProfileTaskManager) {
      base::MessageLoop::current()->PostTask(
          FROM_HERE, base::Bind(&chrome::ShowTaskManager, browser));
   } else if (url_hash_ == profiles::kUserManagerSelectProfileAboutChrome) {
      base::MessageLoop::current()->PostTask(
          FROM_HERE, base::Bind(&chrome::ShowAboutChrome, browser));
   }
 
   // This call is last as it deletes this object.
   UserManager::Hide();
@@ skipping 25 matching lines @@
     Profile* profile, Profile::CreateStatus profile_create_status) {
   Browser* browser = chrome::FindAnyBrowser(profile, false, desktop_type_);
   if (browser && browser->window()) {
     OnBrowserWindowReady(browser);
   } else {
     registrar_.Add(this,
                    chrome::NOTIFICATION_BROWSER_WINDOW_READY,
                    content::NotificationService::AllSources());
   }
 }