make sure only tickets owned by user can be viewed