Might want to validate `user_id` too while you're at it.