code: @SuppressWarnings("unused") // used by jelly
      public boolean isUsingSecurityToken() {
          try {
              return !Jenkins.get().getInstallState().isSetupComplete()
                      && isUsingSecurityDefaults();
          } catch (Exception e) {
              // ignore
          }
          return false;
      }
docs: Indicates a generated password should be used - e.g. this is a new install, no security realm set up