remove the is_staff requirement to be able to do bug association

Also the author of a bug association is always taken from the user
credentials and not from the data POSTED as it used to be