Log authentication errors as soon as possible, use the "warn" level, use the same message whatever the author or protocol.