Core - NotesController ensure we only accept :text and :category all other fields are determined server-side