remove the is_staff requirement to be able to do bug association

Also the author of a bug association is always taken from the user
credentials and not from the data POSTED as it used to be
this is cool.  We could actually remove sending the ``who`` field in the ui with this change, too, if we wanted.