allow login by username or by email