A little bit concerned.  You are fine now, but it is a very fine line, so I want to make sure you are aware.  You are actually opening up the user accessor, not user_id accessor, which are both different.  It gets a bit dangerous when you open up for creation, but then expose an edit/update action and a user takes advantage of this to change the user value.

However, the user accessor takes an object as an argument, so you are less likely to this kind of mass-assignment vulnerability.  Had you used the user_id accessor, then I'd have a stronger objection.