user can login with username or email address