title: Loopback login with phone as username and verification
body: <p>I've extended the User model in my loopback application, and added phone number as a login method, I use the <code>username</code> field to do this, the only deal is that on login I get the 'email not verified' error, I have my own <code>phoneNumberVerified</code> field, and have overwritten the <code>confirm</code> method to validate the token against the <code>emailVerificationToken</code> and against the <code>phoneNumberVerificationToken</code> and update the corresponding flag, I thought of overwriting the original login method to not allow login only if both <code>emailVerified</code> and <code>phoneNumberVerified</code> fields are false (not just the email) but I don't know how to actually do the login the way loopback does it (I believe it creates an <code>AccessToken</code> or something), and I'm asking for some help on how to do this, thanks XD. I can do the overwriting and validations myself I just need to know how to do the actual login without using the original <code>login</code> method, since I'll be rewriting it.</p>