[bugfix] Allow user_id to be set with safe_attributes