Is there any particular reason you have removed the failed attempts checking? regex on the redirect to login (bad cookie) and the error message then providing the user with some feedback with print_error would be nice here.