You probably should validate inclusion of the state in the model (I know you have it in the form but that still relies on data coming from the browser).