Merge "Merge "Allow explicit permission denial" into oc-mr1-dev am: 7fc53a11" into oc-mr1-dev-plus-aosp