separate username and password

The correct behavior (as I have observed through testing) is to separate the username and email in the credentials. When a `redirectAddr` is encountered, it should change the email but preserve the original username.