authenticate with username or email