User Model Improvements

Validate next parameters with a hmac, allow login with username or email address
Fair enough- it just felt a bit uncomfortable but should be fine (we can always look at it with the rest later given that there's at least a few things I've put in that will need refactoring).