The Web2py default is to *not* use username for login. I think your problem is creating your own auth_user table instead of using the default table.
To suppress first/last name collection, set readable/writable in a model or in user() function: db.auth_user.first_name.writable = db.auth_user.first_name.readable = False db.auth_user.last_name.writable = db.auth_user.last_name.readable =False
