Update notes for submitted changes

* Respect security for generic controllers.