Profile unlock should always use session restore, regardless of system preference.

chrome/browser/ui/webui/signin/user_manager_screen_handler.cc

Index: chrome/browser/ui/webui/signin/user_manager_screen_handler.cc
diff --git a/chrome/browser/ui/webui/signin/user_manager_screen_handler.cc b/chrome/browser/ui/webui/signin/user_manager_screen_handler.cc
index d6096417a17eabab48a673c1dd0f49da81dcff3d..a86e5e963554c75582c5883a58d7fade54ca5ef3 100644
--- a/chrome/browser/ui/webui/signin/user_manager_screen_handler.cc
+++ b/chrome/browser/ui/webui/signin/user_manager_screen_handler.cc
@@ -696,8 +696,6 @@ void UserManagerScreenHandler::ReportAuthenticationResult(
   if (success) {
     ProfileInfoCache& info_cache =
         g_browser_process->profile_manager()->GetProfileInfoCache();
-    info_cache.SetProfileSigninRequiredAtIndex(
-        authenticating_profile_index_, false);
     base::FilePath path = info_cache.GetPathOfProfileAtIndex(
         authenticating_profile_index_);
     profiles::SwitchToProfile(
@@ -723,6 +721,14 @@ void UserManagerScreenHandler::ReportAuthenticationResult(
 void UserManagerScreenHandler::OnBrowserWindowReady(Browser* browser) {
   DCHECK(browser);
   DCHECK(browser->window());
+
+  // Unlock the profile after browser opens so startup can read the lock bit.

[bcwhite, 2014/10/30 19:39:44]

Can you add something like "any authentication must have been successful to
reach this point"?

+  ProfileInfoCache& info_cache =
+      g_browser_process->profile_manager()->GetProfileInfoCache();
+  size_t index = info_cache.GetIndexOfProfileWithPath(
+      browser->profile()->GetPath());
+  info_cache.SetProfileSigninRequiredAtIndex(index, false);
+
   if (url_hash_ == profiles::kUserManagerSelectProfileTaskManager) {
      base::MessageLoop::current()->PostTask(
          FROM_HERE, base::Bind(&chrome::ShowTaskManager, browser));