  from django.contrib.auth import authenticate
  from django.core.exceptions import ImproperlyConfigured
  from rest_framework import exceptions, HTTP_HEADER_ENCODING
  from rest_framework.compat import CsrfViewMiddleware
  from rest_framework.compat import oauth, oauth_provider, oauth_provider_store
  from rest_framework.compat import oauth2_provider, provider_now, check_nonce
  from rest_framework.authtoken.models import Token
 
</s> remove         return self.authenticate_credentials(request, auth[1])
 </s> add         return self.authenticate_credentials(request, access_token) </s> remove         if not auth or auth[0].lower() != b'bearer':
 </s> add         if auth and auth[0].lower() == b'bearer':
            access_token = auth[1]
        elif 'access_token' in request.POST:
            access_token = request.POST['access_token']
        elif 'access_token' in request.GET and self.allow_query_params_token:
            access_token = request.GET['access_token']
        else:
from django.conf import settings
  from django.contrib.auth import authenticate
  from django.core.exceptions import ImproperlyConfigured
from django.conf import settings
  from rest_framework import exceptions, HTTP_HEADER_ENCODING
  from rest_framework.compat import CsrfViewMiddleware
  from rest_framework.compat import oauth, oauth_provider, oauth_provider_store
  from rest_framework.compat import oauth2_provider, provider_now, check_nonce
  from rest_framework.authtoken.models import Token
keep add keep keep keep keep keep
 authentication: allow all transport modes of access token in OAuth2Authentication

RFC6750 describe three transport modes for access tokens when accessing a
protected resource:
- Auhthorization header with the Bearer authentication type
- form-encoded body parameter
- URI query parameter

This patch add support for last two transport modes. 
rest_framework/authentication.py