docs: @RequirePOST
      @Restricted(NoExternalUse.class)
      public HttpResponse doCreateAdminUser(StaplerRequest req, StaplerResponse rsp) throws IOException {
          Jenkins j = Jenkins.getInstance();
  
          j.checkPermission(Jenkins.ADMINISTER);
  
          // This will be set up by default. if not, something changed, ok to fail
          HudsonPrivateSecurityRealm securityRealm = (HudsonPrivateSecurityRealm) j.getSecurityRealm();
  
          User admin = securityRealm.getUser(SetupWizard.initialSetupAdminUserName);
          try {
              if (admin != null) {
                  admin.delete(); // assume the new user may well be 'admin'
              }
  
              User newUser = securityRealm.createAccountFromSetupWizard(req);
              if (admin != null) {
                  admin = null;
              }
  
              // Success! Delete the temporary password file:
              try {
                  getInitialAdminPasswordFile().delete();
              } catch (InterruptedException e) {
                  throw new IOException(e);
              }
  
              InstallUtil.proceedToNextStateFrom(InstallState.CREATE_ADMIN_USER);
  
              // ... and then login
              Authentication auth = new UsernamePasswordAuthenticationToken(newUser.getId(), req.getParameter("password1"));
              auth = securityRealm.getSecurityComponents().manager.authenticate(auth);
              SecurityContextHolder.getContext().setAuthentication(auth);
              
              HttpSession session = req.getSession(false);
              if (session != null) {
                  // avoid session fixation
                  session.invalidate();
              }
              HttpSession newSession = req.getSession(true);
  
              UserSeedProperty userSeed = newUser.getProperty(UserSeedProperty.class);
              String sessionSeed = userSeed.getSeed();
              // include the new seed
              newSession.setAttribute(UserSeedProperty.USER_SESSION_SEED, sessionSeed);
              
              CrumbIssuer crumbIssuer = Jenkins.getInstance().getCrumbIssuer();
              JSONObject data = new JSONObject();
              if (crumbIssuer != null) {
                  data.accumulate("crumbRequestField", crumbIssuer.getCrumbRequestField()).accumulate("crumb", crumbIssuer.getCrumb(req));
              }
              return HttpResponses.okJSON(data);
          } catch (AccountCreationFailedException e) {
              /*
              Return Unprocessable Entity from WebDAV. While this is not technically in the HTTP/1.1 standard, browsers
              seem to accept this. 400 Bad Request is technically inappropriate because that implies invalid *syntax*,
              not incorrect data. The client only cares about it being >200 anyways.
               */
              rsp.setStatus(422);
              return HttpResponses.forwardToView(securityRealm, "/jenkins/install/SetupWizard/setupWizardFirstUser.jelly");
          } finally {
              if (admin != null) {
                  admin.save(); // recreate this initial user if something failed
              }
          }
      }