Update notes for submitted changes

* Rationalize how we get roles after authentication in the controllers