Update notes for submitted changes

* Add support for specifying tenant/user/token in the NoAuthMiddleware