Do access protection query at pre_get_posts:28

Firing at priority 10 was causing conflicts with other plugins using the
pre_get_posts hook. Due to a limitation in WP's filter API, calling
remove_filter( $hook ) while in the process of doing $hook will cause other
items hooked to $hook to be removed when those other callbacks are at hooked
at a priority directly adjacent to the original hook. See
https://core.trac.wordpress.org/ticket/17817 for more background on the
limitations of nested remove_action() calls.

Props to @christianwach and @stephenharris for researching the conflict and
suggesting the solution.

Fixes #425