This one's subtle.

The DRF `Request` object wraps the actual `WSGIRequest`. Its `method` attribute is a property. when using `X-HTTP-Method-Override`, `request.method` will return the overriding method instead of POST. OAuth signatures include the actual HTTP method, so auth needs to see the unwrapped request.