          """
  
          auth = get_authorization_header(request).split()
  
          if not auth or auth[0].lower() != b'bearer':
              return None
  
          if len(auth) == 1:
              msg = 'Invalid bearer header. No credentials provided.'
              raise exceptions.AuthenticationFailed(msg)
 
</s> remove         return self.authenticate_credentials(request, auth[1])
 </s> add         return self.authenticate_credentials(request, access_token)
        if auth and auth[0].lower() == b'bearer':
            access_token = auth[1]
        elif 'access_token' in request.POST:
            access_token = request.POST['access_token']
        elif 'access_token' in request.GET and self.allow_query_params_token:
            access_token = request.GET['access_token']
        else:
          """
  
          auth = get_authorization_header(request).split()
  
        if auth and auth[0].lower() == b'bearer':
            access_token = auth[1]
        elif 'access_token' in request.POST:
            access_token = request.POST['access_token']
        elif 'access_token' in request.GET and self.allow_query_params_token:
            access_token = request.GET['access_token']
        else:
              return None
  
          if len(auth) == 1:
              msg = 'Invalid bearer header. No credentials provided.'
              raise exceptions.AuthenticationFailed(msg)
keep keep keep keep replace keep keep keep keep keep
 authentication: allow all transport modes of access token in OAuth2Authentication

RFC6750 describe three transport modes for access tokens when accessing a
protected resource:
- Auhthorization header with the Bearer authentication type
- form-encoded body parameter
- URI query parameter

This patch add support for last two transport modes. 
rest_framework/authentication.py