make the user_id field to be set in the controller. Here in the view someone may change it to something else