changed readme for proper media configuration

images are in /media which is linked to www/media not to www/app/media -
this needs to be symlinked
Fix permissions checks for `eligible_objects`

Ensure that dashboard forms employ the same permission checks as admin
forms. In particular, nodes and devices not managed/owned by the current
user should not be accepted as attribute values.