Restrict ticket creation to users with permission; add CanCan gem