The form shown to users is not the Jenkins 2 setup wizard at all, but a regular Jenkins "first user" form that has existed forever and is the way to set up a user when the security realm is Jenkins user DB, and no user exists.
This issue seems to be with the CREATE_FIRST_USER_FILTER in HudsonPrivateSecurityRealm.
First, the security realm is set. Then, a user is added. Between the two, the servlet filter is installed. Only after the setup wizard finishes installation is its servlet filter installed.
Either there's an ordering issue here, or a race condition. Not sure why HudsonIsLoading would no longer handle requests at that time, though. Doesn't look like it's happening in separate threads.