Update plugin.php

bad_hash cookie may come from attackers.
login attempts by setting fake cookies bypass wp-login.php (wp_login hook)
Merge pull request #1 from ounziw/master

login failure by cookie