add username attribute to user; authorization will use username instead email