fix login optionally with email

• username should be first login check
• allow login with email only if email is unique