function allFailed() {
      if (callback) {
        if (!multi) {
          return callback(null, false, failures[0].challenge, failures[0].status);
        } else {
          var challenges = failures.map(function(f) { return f.challenge; });
          var statuses = failures.map(function(f) { return f.status; });
          return callback(null, false, challenges, statuses);
        }
      }
      
      // Strategies are ordered by priority.  For the purpose of flashing a
      // message, the first failure will be displayed.
      var failure = failures[0] || {}
        , challenge = failure.challenge || {}
        , msg;
    
      if (options.failureFlash) {
        var flash = options.failureFlash;
        if (typeof flash == 'string') {
          flash = { type: 'error', message: flash };
        }
        flash.type = flash.type || 'error';
      
        var type = flash.type || challenge.type || 'error';
        msg = flash.message || challenge.message || challenge;
        if (typeof msg == 'string') {
          req.flash(type, msg);
        }
      }
      if (options.failureMessage) {
        msg = options.failureMessage;
        if (typeof msg == 'boolean') {
          msg = challenge.message || challenge;
        }
        if (typeof msg == 'string') {
          req.session.messages = req.session.messages || [];
          req.session.messages.push(msg);
        }
      }
      if (options.failureRedirect) {
        return res.redirect(options.failureRedirect);
      }
    
      // When failure handling is not delegated to the application, the default
      // is to respond with 401 Unauthorized.  Note that the WWW-Authenticate
      // header will be set according to the strategies in use (see
      // actions#fail).  If multiple strategies failed, each of their challenges
      // will be included in the response.
      var rchallenge = []
        , rstatus, status;
      
      for (var j = 0, len = failures.length; j < len; j++) {
        failure = failures[j];
        challenge = failure.challenge;
        status = failure.status;
          
        rstatus = rstatus || status;
        if (typeof challenge == 'string') {
          rchallenge.push(challenge);
        }
      }
    
      res.statusCode = rstatus || 401;
      if (res.statusCode == 401 && rchallenge.length) {
        res.setHeader('WWW-Authenticate', rchallenge);
      }
      if (options.failWithError) {
        return next(new AuthenticationError(http.STATUS_CODES[res.statusCode], rstatus));
      }
      res.end(http.STATUS_CODES[res.statusCode]);
    }
Authenticates requests.

Applies the `name`ed strategy (or strategies) to the incoming request, in
order to authenticate the request.  If authentication is successful, the user
will be logged in and populated at `req.user` and a session will be
established by default.  If authentication fails, an unauthorized response
will be sent.

Options:
  - `session`          Save login state in session, defaults to _true_
  - `successRedirect`  After successful login, redirect to given URL
  - `successMessage`   True to store success message in
                       req.session.messages, or a string to use as override
                       message for success.
  - `successFlash`     True to flash success messages or a string to use as a flash
                       message for success (overrides any from the strategy itself).
  - `failureRedirect`  After failed login, redirect to given URL
  - `failureMessage`   True to store failure message in
                       req.session.messages, or a string to use as override
                       message for failure.
  - `failureFlash`     True to flash failure messages or a string to use as a flash
                       message for failures (overrides any from the strategy itself).
  - `assignProperty`   Assign the object provided by the verify callback to given property

An optional `callback` can be supplied to allow the application to override
the default manner in which authentication attempts are handled.  The
callback has the following signature, where `user` will be set to the
authenticated user on a successful authentication attempt, or `false`
otherwise.  An optional `info` argument will be passed, containing additional
details provided by the strategy's verify callback - this could be information about
a successful authentication or a challenge message for a failed authentication.
An optional `status` argument will be passed when authentication fails - this could
be a HTTP response code for a remote authentication failure or similar.

    app.get('/protected', function(req, res, next) {
      passport.authenticate('local', function(err, user, info, status) {
        if (err) { return next(err) }
        if (!user) { return res.redirect('/signin') }
        res.redirect('/account');
      })(req, res, next);
    });

Note that if a callback is supplied, it becomes the application's
responsibility to log-in the user, establish a session, and otherwise perform
the desired operations.

Examples:

    passport.authenticate('local', { successRedirect: '/', failureRedirect: '/login' });

    passport.authenticate('basic', { session: false });

    passport.authenticate('twitter');

@param {Strategy|String|Array} name
@param {Object} options
@param {Function} callback
@return {Function}
@api public