Update notes for submitted changes

* Prevent clickjacking of superuser requests