Logging authentication failures on warning level seems more appropriate and makes them easier to spot.