JENKINS-30749 - make Jenkins secure out of the box:

* create initial admin user with difficult password (based on UUID)
* force login with password as security token
* force initial admin user creation

core/src/main/java/hudson/PluginManager.java

@@ -1189,7 +1189,7 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
                         break;
                     }
 			updateCenter.persistInstallStatus();
-                    jenkins.setInstallState(InstallState.INITIAL_PLUGINS_INSTALLED);
+                    jenkins.setInstallState(InstallState.INITIAL_PLUGINS_INSTALLING.getNextState());
                     InstallUtil.saveLastExecVersion();
                 }
             }.start();