Merge "DO NOT MERGE Restore calling identity before checking permission" into klp-dev