The shortcuts that are installed for the user have the option -localfile. This isn't documented anywhere I can find, but it seems specifically to prevent WebStart from checking for updates. If I remove this, there's an update check every time.
I'm reading JNLP docs here: http://docs.oracle.com/javase/6/docs/te
An example JNLP file is here: http://j_banana.users.sourceforge.net/w
Edit: I think I found the problem. Looks like
<shortcut online='false'>causes -localfile and
<shortcut online='true'>doesn't. I was assuming that that attribute meant "only run on line", but looks like it doesn't. The JNLP docs linked above doesn't seem very clear on this.