Merge "Clear calling identity before setting restrictions" into nyc-dev