change token auth to use username not email