code: func WithFailedAuthenticationAudit(failedHandler http.Handler, sink audit.Sink, policy policy.Checker) http.Handler {
  	if sink == nil || policy == nil {
  		return failedHandler
  	}
  	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
  		req, ev, omitStages, err := createAuditEventAndAttachToContext(req, policy)
  		if err != nil {
  			utilruntime.HandleError(fmt.Errorf("failed to create audit event: %v", err))
  			responsewriters.InternalError(w, req, errors.New("failed to create audit event"))
  			return
  		}
  		if ev == nil {
  			failedHandler.ServeHTTP(w, req)
  			return
  		}
  
  		ev.ResponseStatus = &metav1.Status{}
  		ev.ResponseStatus.Message = getAuthMethods(req)
  		ev.Stage = auditinternal.StageResponseStarted
  
  		rw := decorateResponseWriter(w, ev, sink, omitStages)
  		failedHandler.ServeHTTP(rw, req)
  	})
  }
docs: // WithFailedAuthenticationAudit decorates a failed http.Handler used in WithAuthentication handler.
  // It is meant to log only failed authentication requests.