Update notes for submitted changes

* Convert auth_token middleware to use sessions