Only users with the 'change states' permission can change states
Protect state_id from users who do not have permission to change it