Protect state_id in action from users who do not have permission to change it