protect state_id from users who do not have permission to change it