Currently, /api/new_bug uses the service account because v2spa's oauth client id is not whitelisted by the issue tracker service. v2spa should not use a whitelisted client id because it is still under development.
After v2spa launches, it can change client id to something that is whitelisted by the issue tracker service. /api/new_bug will need to override httlib2.Http().request in order to forward the caller's Authorization token to the issue tracker service.