Prevents state_id from hacking.
Only users with the 'change states' permission can change states