Profile unlock should always use session restore, regardless of system preference.

chrome/browser/ui/webui/signin/user_manager_screen_handler.cc

Index: chrome/browser/ui/webui/signin/user_manager_screen_handler.cc
diff --git a/chrome/browser/ui/webui/signin/user_manager_screen_handler.cc b/chrome/browser/ui/webui/signin/user_manager_screen_handler.cc
index c06e509f31cccf917c83a4c749ba56dd0f9238c8..b3d7f51464b3da1b4be01292a0ef06e02e6cd816 100644
--- a/chrome/browser/ui/webui/signin/user_manager_screen_handler.cc
+++ b/chrome/browser/ui/webui/signin/user_manager_screen_handler.cc
@@ -697,8 +697,6 @@ void UserManagerScreenHandler::ReportAuthenticationResult(
   if (success) {
     ProfileInfoCache& info_cache =
         g_browser_process->profile_manager()->GetProfileInfoCache();
-    info_cache.SetProfileSigninRequiredAtIndex(
-        authenticating_profile_index_, false);
     base::FilePath path = info_cache.GetPathOfProfileAtIndex(
         authenticating_profile_index_);
     profiles::SwitchToProfile(
@@ -724,6 +722,15 @@ void UserManagerScreenHandler::ReportAuthenticationResult(
 void UserManagerScreenHandler::OnBrowserWindowReady(Browser* browser) {
   DCHECK(browser);
   DCHECK(browser->window());
+
+  // Unlock the profile after browser opens so startup can read the lock bit.
+  // Any necessary authentication must have been successful to reach this point.
+  ProfileInfoCache& info_cache =
+      g_browser_process->profile_manager()->GetProfileInfoCache();
+  size_t index = info_cache.GetIndexOfProfileWithPath(
+      browser->profile()->GetPath());
+  info_cache.SetProfileSigninRequiredAtIndex(index, false);
+
   if (url_hash_ == profiles::kUserManagerSelectProfileTaskManager) {
     base::MessageLoop::current()->PostTask(
         FROM_HERE, base::Bind(&chrome::OpenTaskManager, browser));