allow login by email OR username