Update notes for submitted changes

* Avoid possible timing attack in metadata api