able to create unexpected relationships via API

The test data generation script sets up two regions and 4 cells. Region #1 has cells #1 & #2, Region #2 has cells #3 & #4. I am able to create a network that is a part of region #2, but also a part of cell #1, which does NOT belong to region #2.

$ curl -X POST -s http://127.0.0.1:8080/v1/networks -H "Content-Type: application/json" -H "X-Auth-Token: demo_root" -H "X-Auth-User: demo_root" -H "X-Auth-Project: b9f10eca66ac4c279c139d01e65f96b4" -d '{"name": "network_region2_cell_1", "region_id": 2, "cell_id": 1, "cidr": "192.168.0.0/24", "netmask": "255.255.255.0", "gateway": "192.168.0.1"}' | jq
{
  "cell_id": 1,
  "cidr": "192.168.0.0/24",
  "created_at": "2017-02-21T22:01:46.485517",
  "gateway": "192.168.0.1",
  "id": 5,
  "ip_block_type": null,
  "name": "network_region2_cell_1",
  "netmask": "255.255.255.0",
  "nss": null,
  "project_id": "b9f10eca66ac4c279c139d01e65f96b4",
  "region_id": 2,
  "updated_at": null
}

This speaks to a fundamental concern with our API exposing the denormalized relational aspects of our schema where every child resource must reference all of its parents instead of just its immediate parent where further traversal of the hierarchy is inferred from the parent.