restrict actions in ticketscontroller based on permissions and hide links