Allow passing of email instead of username for password grant.

If we do not find the username, we check for a user with the email
address. This is ok in the case of edX but would be dangerous for
a generic Django install because:

1. Email addresses are not guaranteed to be unique in Django.
2. Django allows @'s and periods in usernames, leading to potential
   ambiguity.

The usernames in edx-platform are more restricted, and a unique
constraint is placed on the email field.

This is not really a great approach, but the alternatives are
cumbersome. We can either:

1. Add an explicit email field to the request, in which case we
   are no longer actually adhereing to the OAuth2 spec.
2. Create some intermediate layer that, given an email and
   password will forward things onto the OAuth2 provider or return
   a username to the requestor, allowing them to make the
   appropriate request. But this forces a non-standard sort of
   auth flow.