Update notes for submitted changes

* Do the same auth checks in the v2 API as in the v1 API