Protect state_id from users who do