enforce write permission on cas ticket cache