Validate the model id if it's in the data

it should match the id in the url or something's not right and probably
it's a malicious request
verify that the user isn't trying to edit somethign else

And if they are - throw an exception