conditionally use one of either username or userid for auth