[core] log invalid password IPs (fixes #386)