[JENKINS-55945] IllegalStateException trying to get user. (#4107)

This change catches the exception and returns false, invalidating the user session. This behavior is sensible, because if we are unable to validate the user we must assume the session is invalid.
Catching the error at this point reportedly helps with some scenarios and shouldn't cause any further harm.

core/src/main/java/hudson/security/HttpSessionContextIntegrationFilter2.java

@@ -84,7 +84,13 @@ private boolean hasInvalidSessionSeed(Authentication authentication, HttpSession
             return false;
         }
 
-        User userFromSession = User.getById(authentication.getName(), false);
+        User userFromSession;
+        try {
+            userFromSession = User.getById(authentication.getName(), false);
+        } catch (IllegalStateException ise) {
+            logger.warn("Encountered IllegalStateException trying to get a user. System init may not have completed yet. Invalidating user session.");
+            return false;
+        }
         if (userFromSession == null) {
             // no requirement for further test as there is no user inside
             return false;