Allow login with either username *or* email

NB currently requires logging in with a username.   Users frequently get confused and provide their email instead, and don't understand when their login then fails.   The obvious fix is to permit login using email address as well as username.   If we check for a matching username first, then we'll even cover the weird cases where a user's external name is equal to some other user's email 