Protect state_id from users who do not have permissions to change it.