both username and email can login, and validates username to be unique
user.rb validation