Security roles for portal user

I have created a customer self-services portal in crm online .And i am trying to give security roles for different user.

-I have two user(admin-full privilege ,user-read only)

-In "Web Role"  i am using the default administrators role for admin and custom 'test' role for user.

-In "Entity permission" for same entity i created two privilege types(1.admin-user,2.user) and add the web roles respectively with scope as 'global'.

-I have also enable the "enable entity permission" in entity form & list.

but when trying to login with "user" privilege i can even edit the form.Is there any more steps required to config the sec roles.