Restrict actions in TicketsController based on permissions and hide links

Had a bunch of problems with a few tests. perhaps things were out of order
or the tests didnt run properly.

Need to take a second look at the whole application without moving forward