Authenticating proxy tickets