routes/user.js: return username while using email to login
fix set curUser