On second thought, instead of adding ```def addChallengeToResponse(response: HttpResponse): HttpResponse``` to ```HttpAuthenticator```, I think it would be more consistent to add a method ```def getChallengeHeaders: List[HttpHeader]``` to ```HttpAuthenticator```. This because, in ```RejectionHandler``` all rejections use the ```CompletionMagnet``` to create the ```HttpResponse``` object behind the scenes. When you have a method that transforms that response, it is no longer possible to use the ```CompletionMagnet``` to create the response object. To prevent the duplication of the (small amount of) logic required to create the ```HttpResponse```, just asking the ```HttpAuthenticator``` for the headers seems better. An authenticator shouldn't have to do more than add some headers to the request, so just returning these headers would be enough.