Protect state_id from users who do
not have permission to change it