fix bug in auth logic, use only username for first_or_create criteria