update user model to authenticate against username rather than email