Public HTTP methods should override `auth_username_field`

Addresses #70