Update notes for submitted changes

* Deny API requests where context doesn't match path