code: func instrumentAuthenticationError(r *http.Request, username string, err error) {
  	ctx := r.Context()
  
  	remoteIP := realip.RealIP(r)
  
  	logger.Info(ctx,
  		"authentication.failure",
  		"username", username,
  		"remote_ip", remoteIP,
  		"err", err,
  	)
  
  	var reason string
  	switch err {
  	case auth.ErrTwoFactor:
  		reason = "two_factor"
  	case auth.ErrForbidden:
  		reason = "forbidden"
  	default:
  		reason = "error"
  	}
  
  	tags := []string{
  		fmt.Sprintf("username:%s", username),
  		fmt.Sprintf("remote_ip:%s", remoteIP),
  		fmt.Sprintf("reason:%s", reason),
  	}
  	stats.Inc(ctx, "authentication.failure", 1, 1.0, tags)
  }
docs: // Called when a request fails authentication/authorization checks, which logs
  // and increments metrics. Can be useful for alerting on.