Allow for case-insensitive finding of user by username/email

Allow `User.find_for_session` to intake case insensitive data.

Also, a little cleanup - there was some unnecessary duplication.