Protect state_id from users lacking permission to change it