sorry for multiple opening cases... :-|
I do have a similar problem like ticket #21236.
The secret code for the admin page is not working correctly.
A secret code is set and enabled but the default URL /administrator is still available and visible.
Also a login by the normal /administrator prompt is successfull.
A successfull login is also available by opening /adminstrator?secretkey
Thank you