add access control for edit tickets