I have been having the same problems and I solved using another related ajax function: Just changing your

check_ajax_referer( 'login_nonce', $_POST['security'], false )

to

wp_verify_nonce( $_POST['security'], 'login_nonce' )

seems to work and return true / false correctly. About if it's more secure one way or other I have found this info:

wp_verify_nonce vs check_admin_referer

I have been having the same problems and I solved using another related ajax function: Just changing your

check_ajax_referer( 'login_nonce', $_POST['security'], false )

to

wp_verify_nonce( $_POST['security'], 'login_nonce' )

seems to work and return true / false correctly. About if it's more secure one way or other I have found this info:

wp_verify_nonce vs check_admin_referer