now authenticates against username instead of email
basic curl test works