Merge "Don't autogrant permissions on managed profiles" into oc-mr1-dev