restrict TicketsController actions and hide links