allow logins via email address or username