Update notes for submitted changes

* Protect oauth controller calls and update policy.json