add access control for delete tickets