Fix for missed renamed variable 'annot'->'note'
Annotations endpoint requires SSL.

Since annotations require a login and the session cookie is set as secure.  Non ssl attempts fail login check.