Update notes for submitted changes

* Only public user fields in unauthorized requests