Update notes for submitted changes

* Adding OSSN-0017 - Session-fixation vulnerability in Horizon when using the default signed cookie sessions