add validation of access to wp-login.php