restrict action in ticket controller based on permission