Fix restriction cache when whitelisting

onDemandWhitelist wasn't updating the cache, so the immediate effect was that the restriction cache still contained the restricted value from the database.