Merge "Lock down MANAGE_DOCUMENTS permission." into klp-dev