Cast a broader net when checking for wp-login.php for spammed users

By checking only $_GLOBALS['pagenow'], we're relying on WordPress to have
initialized properly. In some instances, this does not happen reliably, so
we add a fallback to the value of $_SERVER['SCRIPT_NAME']. This helps to
prevent redirect loops for spammers in a larger number of instances.

git-svn-id: https://buddypress.svn.wordpress.org/trunk@7515 cdf35c40-ae34-48e0-9cc9-0c9da1808c22