auth: authenticate using either username or email address

Use User.get_by_username_or_email() in get_user.
In authenticate(), update username if get_user succeeds.

The point of this change is that the web login is a complex thing that
includes, apart the authentication itself, form validation and a bunch of
other things.

This change on its own makes it possible to authenticate a user using its email
address, but that on its own isn't enough for web login or git/hg auth.