Both of these hidden fields can easily be changed by the user on the frontend using the Chrome Web Inspector, allowing me to take someone else's goal (I think), or assign a goal to someone else.

Since you get `@reviewable_goal.id` from the URL this POSTs to, and `current_user` is available in the controller too, really you don't need either of these hidden fields. You can just merge the params in the controller.