      """
      OAuth 2 authentication backend using `django-oauth2-provider`
      """
      www_authenticate_realm = 'api'
  
      def __init__(self, *args, **kwargs):
          super(OAuth2Authentication, self).__init__(*args, **kwargs)
  
          if oauth2_provider is None:
              raise ImproperlyConfigured(
 
</s> remove         return self.authenticate_credentials(request, auth[1])
 </s> add         return self.authenticate_credentials(request, access_token) </s> remove         if not auth or auth[0].lower() != b'bearer':
 </s> add         if auth and auth[0].lower() == b'bearer':
            access_token = auth[1]
        elif 'access_token' in request.POST:
            access_token = request.POST['access_token']
        elif 'access_token' in request.GET and self.allow_query_params_token:
            access_token = request.GET['access_token']
        else:
    allow_query_params_token = settings.DEBUG
      """
      OAuth 2 authentication backend using `django-oauth2-provider`
      """
      www_authenticate_realm = 'api'
    allow_query_params_token = settings.DEBUG
  
      def __init__(self, *args, **kwargs):
          super(OAuth2Authentication, self).__init__(*args, **kwargs)
  
          if oauth2_provider is None:
              raise ImproperlyConfigured(
keep keep keep add keep keep keep keep keep keep
 authentication: allow all transport modes of access token in OAuth2Authentication

RFC6750 describe three transport modes for access tokens when accessing a
protected resource:
- Auhthorization header with the Bearer authentication type
- form-encoded body parameter
- URI query parameter

This patch add support for last two transport modes. 
rest_framework/authentication.py