Addresses ENG-8549.
The only place with missing check was UpdateDeviceList.

• Had user with two mobile devices (primary and secondary)
• Called the RPC with different auth metadata - switched device_id metadata between primary and secondary
• The RPC accepted request from primary device and rejected from the secondary.

Note that the RPC can also reject requests because of invalid signature so it's good to test it without signatures.