auth: allow web login with email addresses

Let users log in using their email addresses instead of their user names.
This only applies to the web login, not git+http or hg+http protocols.