(stable) Fix credential control logic for restricted credentials
Summary: Fixes T12975. This logic didn't deal with PolicyException correctly.
Test Plan:
Reviewers: chad
Reviewed By: chad
Maniphest Tasks: T12975
Differential Revision: https://secure.phabricator.com/D18537