I think I found a bug in lightswitch and I searched throughout google to try to find someone else who has the same problem, but haven't had any luck so far.
Seems that lightswitch caches the entities' delete/insert/update/view permissions into some files called __GetEntitySetCanInformation?entitySetName=EntityName in the temporary internet files directory. The problem is that if you login with a diferent user, the permissions to the entities remain the same as it was for the previous user. So if you where logged with a user who has update permission to a certain entity, when you login with a diferent user, he will have update permission to this entity even if he wasn't suposed to have.
I don't have this problem in chrome. Just in internet explorer. Tested in ie7 and ie8, both have the same problem. Also tested in other computers and all of them had the same problem.
I created a logout button in my application that calls an asp.net page that does all the loging out. I tryed to make it also remove all cookies, but didn't work. I can't find a solution for this.
-- Added - 08/02/2012 --
I also added a discussion about this in MSDN forum. No one solved this issue for me there neither, but there are a few more information about this.
The link to the discussion is http://social.msdn.microsoft.com/Forums/en-US/lightswitch/thread/ec704f5f-77f1-40a8-9c6f-ea0fff56db75?prof=required
