The form shown to users is not the Jenkins 2 setup wizard at all, but a regular Jenkins "first user" form that has existed forever and is the way to set up a user when the security realm is Jenkins user DB, and no user exists.
This issue seems to be with the CREATE_FIRST_USER_FILTER in HudsonPrivateSecurityRealm.
First, the security realm is set. Then, a user is added. Between the two, the servlet filter is installed. Only after the setup wizard finishes installation is its servlet filter installed.
Either there's an ordering issue here, or a race condition. Not sure why HudsonIsLoading would no longer handle requests at that time, though. Doesn't look like it's happening in separate threads.
This is my first time play with Jenkins so I don't think anything leftover there.