column_editable_list do not obey can_edit settings

When can_edit = False, columns in column_editable_list are still editable

[djpnewton]

so what do you do when you want to be able to edit a couple of fields via column_editable_list but dont want the entire record to be able to be updated?

For example I only want the admin to be able to edit a users roles but I dont want them to have access to the entire record editing form

[vvch]

For example when can_edit is a callback property which returns True or False depending on current user permissions. And column_editable_list is a constant list. In this case (which seems to be very common) ability to edit fields for those users for whom editing was explicitly prohibited could become a big surprise and a security hole. Or any other case when can_edit was true with column_editable_list, but then it was set temporarily false in runtime.