Update notes for submitted changes

* Enforce authenticated=False in saml2 plugin