Update notes for submitted changes

* Don't call credentials_headers() twice