Update notes for submitted changes

* Derive HMAC secret from hashed password and salt