Update notes for submitted changes

* secrets.get should verify that the request is for a single secret