Note `authenticate` usage with custom user model.

If using a custom user model, with eg `USERNAME_FIELD='email'`,
then it is non-obvious if the correct usage is `authenticate(username=..., password=...)` or `authenticate(email=..., password=...)`
Bit of an easy stumbling point, so we should really note the usage here.