In think the primary key should be excluded as well, some interesting attacks can be done by sending a different id in the form.