Update notes for submitted changes

* properly quote www-authenticate header value