We need at least the username for password based auth or the email address for oauth based auth, not the two.