feat: add logic to prevent edit for some user accounts

mostly for sake of online demo, so a "permanent" demo user can be
established

tests/views/test_users.py

@@ -42,6 +42,26 @@ class TestUserView(WebTestCase):
         user.active = False
         self.assertEqual(view.grid_row_class(user, data, 1), 'has-background-warning')
 
+    def test_is_editable(self):
+        model = self.app.model
+        view = self.make_view()
+
+        # active user is editable
+        user = model.User(username='barney', active=True)
+        self.assertTrue(view.is_editable(user))
+
+        # inactive also editable
+        user = model.User(username='barney', active=False)
+        self.assertTrue(view.is_editable(user))
+
+        # but not if prevent_edit flag is set
+        user = model.User(username='barney', prevent_edit=True)
+        self.assertFalse(view.is_editable(user))
+
+        # unless request user is root
+        self.request.is_root = True
+        self.assertTrue(view.is_editable(user))
+
     def test_configure_form(self):
         model = self.app.model
         barney = model.User(username='barney')