That line need to be discussed: that's the only one I had to change in tests to be able to run those against both Piston and DRF implementation of OAuth. Given that this check doesn't look to be performed on Piston's one, it may break existing clients when we switch to DRF if they don't use that header…