We should not look up user accounts by email address.

[inghamn]

Right now, when looking for an active user, inRoads looks in both the username and password field. One result of this, is that city employees can login with either CAS or Auth0.

However, during account deletion, we are currently only clearing out the username field. We probably want to keep the email address of people, even if they're no longer an active user. That way we can still reach out to past users, if need be.

I think the right thing to do is to only look up user accounts using the username field. For Auth0 users, the username field will be the email address they use in Auth0. If there's a downside to this, it's that user accounts will no longer be able to use either authentication system, since the usernames for city accounts are not email addresses.