> case class AuthenticationFailedRejection(cause: AuthenticationFailureCause, authenticator: HttpAuthenticator)

Yes, that is much better.
Let's do it that way!
So we add a `def addChallengeToResponse(response: HttpResponse): HttpResponse` method to `HttpAuthenticator` and have the default `RejectionHandler` call it.