feat(auth): allow logging in with either username or email address