Update notes for submitted changes

* Return 401 when action is not authorized