Protect state_id from user who do not have permission to change it