users / admins can log in with username / email address