prevent changing Status for new issues

I'm having trouble configuring Roundup.

I am working from the "devel" template and thus have User and Developer
roles (in addition to others).

I want Users, when creating a new issue or editing an existing one,
not to be able to change the status or resolution fields.  When a new
issue is created, I want status to automatically be assigned 1/new
and not changeable when editing existing issues. 
For Developers, I want the status and resolution fields to be normal.

In schema.py, I removed 'status' and 'resolution' in the following
statement:
    for cl in ('priority', 'status', 'resolution',
           'issue_type', 'issue', 'file', 'msg'):
        db.security.addPermissionToRole('User', 'Create', cl) 
so that now, the only permission the User role has to 'status' and
'resolution' is View.  I also enabled the statusauditor.py detector.

Yet users with only User role can still set status and resolution to
be anything when creating a new issue.  Editing existing issue seems
ok (no change of status or resolution allowed).

I think I am misunderstanding how permissions work.  How do I get 
the behavior I am looking for?

------------------------------------------------------------------------------
Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk