fix role setting
ensure ticket transfers work and don't show users unauthorised pages