user can login w username or email.  email uniqueness validated.  emails are downcased on save