Merge "Clear caller identity before updating restrictions" into main