Is there a way to authenticate users using their email only, not their username?

Yes, that will work. But is there a way to let them have a username other than their email, but only be able to log in with their email address?