code: func WithAuthentication(handler http.Handler, auth authenticator.Request, failed http.Handler, apiAuds authenticator.Audiences) http.Handler {
  	if auth == nil {
  		klog.Warningf("Authentication is disabled")
  		return handler
  	}
  	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
  		if len(apiAuds) > 0 {
  			req = req.WithContext(authenticator.WithAudiences(req.Context(), apiAuds))
  		}
  		resp, ok, err := auth.AuthenticateRequest(req)
  		if err != nil || !ok {
  			if err != nil {
  				klog.Errorf("Unable to authenticate the request due to an error: %v", err)
  			}
  			failed.ServeHTTP(w, req)
  			return
  		}
  
  		// TODO(mikedanese): verify the response audience matches one of apiAuds if
  		// non-empty
  
  		// authorization header is not required anymore in case of a successful authentication.
  		req.Header.Del("Authorization")
  
  		req = req.WithContext(genericapirequest.WithUser(req.Context(), resp.User))
  
  		authenticatedUserCounter.WithLabelValues(compressUsername(resp.User.GetName())).Inc()
  
  		handler.ServeHTTP(w, req)
  	})
  }
docs: // WithAuthentication creates an http handler that tries to authenticate the given request as a user, and then
  // stores any such user found onto the provided context for the request. If authentication fails or returns an error
  // the failed handler is used. On success, "Authorization" header is removed from the request and handler
  // is invoked to serve the request.