Even though the documentation of DISALLOW_CREATE_WINDOWS says it is for Device Owners and Profile Owners on User 0 only, it was previously not part of DEVICE_OWNER_USER_RESTRICTIONS and was therefore callable from a profile owner on a managed profile or secondary user. Bug: 19726884 Change-Id: If6443eacbc28b7ee6c0845754923573a79f8bde3