a few changes 

- you can't delete finalized notes, so I changed the delete method
- you shouldn't check for ownership in the views, better do this in the controller. I changed this as a suggestion -> NoteAccessService
- you have to check for ownership in several methods, otherwise anyone can read the notes by changing the id parameter in the url
- The easiest way to fix your list.gsp is by manually removing the fields you don't want and add others manually, e.g. I removed note 
- I fixed some dependency problems in the prototype plugin (in case you have trouble with it, too, I can push the changes)
- I changed your BuildConfig to recognize the OpenLabBackend again, which hopefully means you can correctly resolve class imports from now on.
- It is important to specify a table name for NoteItem, because otherwise it will default to olfDomainObject -> definitely not what we want and also does not work anymore on a proper database.