Merge \"Allow apps with CREATE_USERS permission to create restricted users.\" into nyc-dev
am: 48ee87d4a7

Change-Id: Ib61fe36aef8fc992e87ccaa692cc2712caf36570