authentication with username instead of id