There is a little bug here.
In your controller, function save()
Replace
if (!$this->can('core.edit', JText::_("JTOOLBAR_SAVE")))
return;
// Check for request forgeries
JRequest::checkToken() or jexit( 'Invalid Token' );
$cid = JRequest::getVar( 'cid', array(), 'post', 'array' );
$post = JRequest::get('post');
$post['id'] = (int) $cid[0];
By
// Check for request forgeries
JRequest::checkToken() or jexit( 'Invalid Token' );
$cid = JRequest::getVar( 'cid', array(), 'post', 'array' );
$post = JRequest::get('post');
$post['id'] = (int) $cid[0];
if ((((int)$cid[0] > 0) && !$this->can('core.edit', JText::_("JTOOLBAR_SAVE")))
|| (((int)$cid[0] == 0) && !$this->can('core.create', JText::_("JTOOLBAR_SAVE"))) )
return;
Corrected for next version