Merge "Allow device/profile owners to change app ops modes." into pi-dev