allow to login by email or username (and testing for both)