Generalize rate limiting for backend without username

The `RateLimitMixin.authenticate` method requires a username to be specified.  This doesn't work for a backend that uses `email` for authentication instead.