Update notes for submitted changes

* Ensure records belong to the domain_id supplied in the URL