restrict actions in tickets controller based on permissions and hide links