Update notes for submitted changes

* Move auth_token middleware from admin user to an RBAC policy