fix: Restrict access to closed tickets

When checking ticket access - only consider assignment IF the ticket is
open. This is required since staff_id field is overloaded to show who closed
the ticket.