auth: authenticate using either username or email address Use User.get_by_username_or_email() in get_user. In authenticate(), update username if get_user succeeds. The point of this change is that the web login is a complex thing that includes, apart the authentication itself, form validation and a bunch of other things. This change on its own makes it possible to authenticate a user using its email address, but that on its own isn't enough for web login or git/hg auth.