user = User.query.filter(User.username == username, User.email == email).first()