Merge "Document restricted app private file permissions" into nyc-dev