Merge "Auto-call prepare() for new always-on VPNs" into nyc-dev