User can become admin of a space by creating an AWM app

Reproduction step:

• Register a new user U1 (without script right)
• Login as U1
• Create an AWM application name "Test" (http://localhost:8080/xwiki/bin/view/AppWithinMinutes/CreateApplication?wizard=true)
• Visit the new Test app (http://localhost:8080/xwiki/bin/view/Test/)

Expected results:
The users does not have more rights than necessary.

Actual result:
The user is Admin (implying Script right) of the "Test" space (including its sub-pages), allowing a untrusted user to create pages with persistence XSS (among other things).

Note 1: the affect versions needs to be refined.
Note 2: Probably a side effect by any other non-admin user clicking on "More application" at the top left is redirected to a page with the following message "You are not allowed to view this page or perform this action." (http://localhost:8080/xwiki/bin/admin/XWiki/XWikiPreferences?editor=globaladmin&section=XWiki.AddExtensions)