Update notes for submitted changes

* auth tests should not require admin token