Merge "incident_service: only disallow untrusted access"