Update notes for submitted changes

* don't attempt to verify against an unset password hash