Merge "Disallow prepare()-ing over an always on VPN app" into nyc-dev