Restrict actions in the TicketsController based on permissions and hide link