Apparently CREATE LOGIN only accepts literals.
You could try wrapping it in an exec and building it as a string:
EXEC('CREATE LOGIN ' + quotename(@username) + ' WITH PASSWORD = ' + quotename(@password, ''''))
edit: added quotename for safety from sql injection attacks