Symptoms

Application rights on registration wizard set to 'Manage', not 'Full Control', after provisioning Appit at root level site collection.
 

Diagnoses

This is expected behavior due to differences in architecture in SharePoint, a limitation imposed by Microsoft to not allow custom script at the root level of a SharePoint site. Microsoft has implemented security changes disabling scripting on a Site Collection. This is a protection mechanism to ensure users do not do anything malicious to the Host Site Collection. The security changes prevent uploading of scripts and will cause the error if you try uploading an ASPX file.
 

Resolution

Custom Script can be allowed by enabling rights through Tenant Administration by navigating to SharePoint Admin Center > Settings then browse down the page to the Custom Script area and changing the options to 'Allow users to run custom script" (Both options)

A more detailed description of this can be found in this KB article: http://help.k2.com/kb001711