          elif len(auth) > 2:
              msg = 'Invalid bearer header. Token string should not contain spaces.'
              raise exceptions.AuthenticationFailed(msg)
  
          return self.authenticate_credentials(request, auth[1])
  
      def authenticate_credentials(self, request, access_token):
          """
          Authenticate the request, given the access token.
          """
 
</s> remove         if not auth or auth[0].lower() != b'bearer':
 </s> add         if auth and auth[0].lower() == b'bearer':
            access_token = auth[1]
        elif 'access_token' in request.POST:
            access_token = request.POST['access_token']
        elif 'access_token' in request.GET and self.allow_query_params_token:
            access_token = request.GET['access_token']
        else:
        return self.authenticate_credentials(request, access_token)
          elif len(auth) > 2:
              msg = 'Invalid bearer header. Token string should not contain spaces.'
              raise exceptions.AuthenticationFailed(msg)
  
        return self.authenticate_credentials(request, access_token)
  
      def authenticate_credentials(self, request, access_token):
          """
          Authenticate the request, given the access token.
          """
keep keep keep keep replace keep keep keep keep keep
 authentication: allow all transport modes of access token in OAuth2Authentication

RFC6750 describe three transport modes for access tokens when accessing a
protected resource:
- Auhthorization header with the Bearer authentication type
- form-encoded body parameter
- URI query parameter

This patch add support for last two transport modes. 
rest_framework/authentication.py