Use key "username" (not "user") for loginWithUsername