restrict ticket updating to those who have permission