Update notes for submitted changes

* Create user returns 400 without a password