You could clean this up by creating an `allow_query_params_token = settings.DEBUG` class attribute on the `OAuth2Authentication` class.  For the purposes of this test you could then just subclass `OAuth2Authentication` and force `allow_query_params_token = True`.