Remove User.api_key, sync migrations
Remove User.username, we use the email as a primary identity