Merge "Heed user shell restriction for pm calls" into nyc-dev