I don't think that's necessary. This is an administrator controller which acts on a model that has 2 attributes. I don't see a real security risk here, but perhaps I'm missing something.