Update notes for submitted changes

* OAuth authorizing user should propose roles to delegate