Update CHANGELOG and RELEASE_NOTES for authz_timeout