Update notes for submitted changes

* Make webob.exc.HTTPForbidden return correct message