content_permissions module, hidden field still viewable to user role

Right now in my permissions I have the settings so that a user role can only edit a CCK nodereference field. The user has edit privileges because the prepopulate module needs to insert the linking node. The "view field" setting is NOT checked, yet when I log in as that user that user can still see the nodereference.

This is confusing me to no end. Any suggestions?