oauth: fix password-based login when username is email address