Update notes for submitted changes

* xenapi: Tidy up Popen calls to avoid command injection attacks