Restrict actions in TicketsController (p 223)