Security: prevent AJAX modelform from being used to update arbitrary
fields, it should only be able to update those listed in
the AjaxModelAdmin's `ajax_list_display` property.