Wordpress 4.0 update. Allow every input to admin-ajax.php, because Wordpress sends a random parameter name to it on login.