Don't disable username validation when !auth.use_usernames (issue #759)

This would have allowed e.g. duplicating a username someone else had
created, which could break logins (if auth.login_type was not
set specifically to 'email').

Also fix the username field to be required when
auth.login_type == 'username' (even if auth.use_usernames is disabled).