Update notes for submitted changes

* Add WWW-Authenticate header in 401 responses.