restrict actions in tickets controller based on permissions