Some people have been requesting this forever. So finally this works:

service tcpwrap { unix_listener login/tcpwrap { mode = 0666 } } login_access_sockets = tcpwrap

There can also be more sockets listed, in case someone wants to build their own access checking service.