Update notes for submitted changes

* Don't recommend setting SESSION_COOKIE_HTTPONLY