Merge "Grant ephemeral app access during service bind" into oc-dev