Merge "Disallow external storage access without restricting other api calls" into tm-dev