In the method check_ajax_referercheck_ajax_referer()
, the second parameter is not the nonce value, is the key of the post request param.
check_ajax_referer( 'login_nonce', 'security', false );
check_ajax_referer( 'login_nonce', 'security', false );