restrict action in ticketscontroller based on permissions and hide links