this is fine as long as you can defend your decision to make :user_id mass-assignable