On our 2.9.3 site, we use "restricted access" which shows/hides External Links depending on what information in customer user profile fields (these are updated by web service). If the student triggers the web service (via purchase) the field is updated and thus, the extra resources are released/viewable by the student.
However, recently we found that the restricted access won't get triggered unless a student goes to /my (My Moodle/Dashboard) first. This generally would not be a problem except that we are often returning students to their last known progress (via a "resume" link).
Additionally, once unlocked, if a student logs out and then logs back in we find that they need to re-visit /my to release the resources once more.
We are a bit stumped by the issue, and quite frankly we aren't sure if it's related to web services (we have a hunch if might be cache related). We have found this ticket which alludes to the issue (but remains open) https://tracker.moodle.org/browse/MDL-52776
We are using Moodle 2.9.3 (Build: 20151109)