Update notes for submitted changes

* Always validate auth_uri with allowed_auth_uris