protect state_id from users without change states permissions