CartoDB/cartodb — pull request #1627 by juanignaciosl (2014-12-29 17:29:09+00:00)
Title: Retrieve username for authentication if email is present fixes #1626

@Kartones CR this, please. I don't know if it's the most elegant way of fixing this. Warden finds user both by username and email, but session registration works only with username (the value of `scope` when calling `authenticate!`), so instead of touching inside authentication itself I prefer sending always the username. If it's not found it sends email just to keep previous behaviour and don't reveal whether that email is registered. Form displays domain, so I think there's no information disclosure here.
There's a unique restriction on email users table column, so you can use one instead of the other without risk.