Update notes for submitted changes

* escape HTML in system notes instead of passing it through