I think we need a permission check here, like this from AgentTicketLock:

```
# check permissions
    my $Access = $Self->{TicketObject}->TicketPermission(
        Type     => 'lock',
        TicketID => $Self->{TicketID},
        UserID   => $Self->{UserID}
    );
```
Somebody could just call the URL with arbitrary TicketIDs, you know?