Update plugin.php

bad_hash cookie may come from attackers.
login attempts by setting fake cookies bypass wp-login.php (wp_login hook)