I assigned a user to a Reader role but it can edit and save changes, which is wrong
Which version do you use? Are you sure you do not another client with anonymous access?
The version used is 7.21, yes i am sure there is no other client
So far I cannot reproduce it.