access user model based on ( username OR email ) AND password