is_login() will trigger on non-login pages

[govpress]

The test for is_login() will falsely issue "true" in two circumstances we've observed.

1) the root page "/"
2) any page request that matches a part of the URL that follows a "/"

eg in this example a request for "/d" is a login page, but "/d/" is not.

php > $url = "https://documents.example.com/wp-login.php";
php > echo stripos($url, "/");
6
php > echo stripos($url, "/documents");
7
php > echo stripos($url, "/doc");
7
php > echo stripos($url, "/d");
7
php > echo stripos($url, "/d/");
php > echo stripos($url, "/wp-login.php");
29
php > echo stripos($url, "/w");
29
php > echo stripos($url, "/xxx");
php > 

[govpress]

I should note that this is on a server nginx + fastcgi php-fm with the parameter

fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;

where the value of _SERVER['SCRIPT_NAME'] will usually be the path of the requested URL, not /index.php.

_SERVER['SCRIPT_NAME'] = /
_SERVER['SCRIPT_FILENAME'] = /var/www/html/index.php