Under User Management tab "End User" make sure the user is correctly associated to the device(s) they are attempting to control. Then under Permissions make sure you have selected both "Std CCM Users and Std CTI Enabled, then click save.
Should go without saying but also make sure if you have a user with a common name like SMith, Jones, etc., that you are selecting the correct person to enable privleges for. That has bitten us a couple times.
Other than that I have seen one particularly troublesome case (still outstanding) where the user cannot log in to CCMUSER using IE but has no difficulty logging in from FireFox. Might be worth a try.
Original MUG/NAMU Charter Member