Allow wp-admin to use index.php

while still blocking direct hits.

Props to @darkwing for this fix on bug 864724