override AuthenticationForm.clean to accept both username and email