restrict ticket viewing to correct access