Different plans or buffers for different connections?
When you say "same params and all" then you may find different credentials were used or the same compiled plan wasn't re-used based on timing. 

I suspect here that the first web call and the SSMS call used different plans. The DBCCs then cleared the plan, so the second web call worked as expected

There are criteria that determine plan re-use such as using schema on all object references (eg dbo.table not table) which will be affected by different credentials.

However, the main culprit is usually parameter sniffing. See


Does restarting SQL Server speed it up?
Suddenly Slow Execution Plan for Stored Proc
Code creates different plan when ran ad-hoc vs. in a stored procedure


Failing that, some SET options may be different too:


Why would SET ARITHABORT ON dramatically speed up a query?


Note: these follow through to good background reading...