restrict access to tickets