a) Why are you allowing them to login with both email and username.  That feels like a 'nice to have' feature not a 'need to have' -- this should have been iceboxed.
b) It should be the model's responsibility to figure out which one is used and find the instance.  Create `User.find_by_username_or_email`