this is fine as long as you can defend your choice to allow mass assignment of user_id