Password Protect login URL still accessible when protection disabled

[benhuson]

For example, visiting the URL directly shows the login form: http://example.com/?password-protected=login

It should probably redirect to redirect URL if set, or home.

See: https://wordpress.org/support/topic/password-protection-still-visible-while-deactivated