Update notes for submitted changes

* Don't raise HTTPForbidden on a multitenant environment