Two accounts can fail to login when request auth token if username/email are same

[alexdlaird]

Since users can login with either username or email, the username field can be populated with either a username, or an email address, and the token route will look in the DB for either/or. However, if one account's username is the same as another account's email address, a collision happens at this point, and an error is thrown. The user can't login.

When adding tests for this, should also add a test to the "change email/username" path, to ensure the collision can't be caused at that point either.

[alexdlaird]

This was most easily solved by now allowing @ in the username. Your username should be unique from your email anyway, and if you want to login with your email instead, you still can.