Protect state_id from users who don't have permission to change it