use username for auth if no email match