Login accepts both - username or email