the `:list_id` attribute isn't submitted from the form, so why permit it here?