require username when signing up; allow users to login with username or email; change named profile routes to use username