use username instead of email for authentication