Fix race condition during initial admin account creation

core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java

@@ -363,11 +363,14 @@ private String getErrorMessages(SignupInfo si) {
      * This can be run by anyone, but only to create the very first user account.
      */
     @RequirePOST
-    public void doCreateFirstAccount(StaplerRequest2 req, StaplerResponse2 rsp) throws IOException, ServletException {
+    public synchronized void doCreateFirstAccount(StaplerRequest2 req, StaplerResponse2 rsp)
+            throws IOException, ServletException {
+
         if (hasSomeUser()) {
             rsp.sendError(SC_UNAUTHORIZED, "First user was already created");
             return;
         }
+
         User u = createAccount(req, rsp, false, "firstUser.jelly");
         if (u != null) {
             tryToMakeAdmin(u);