Add domain_root_only restriction to app manifests

And add app label to app map