added: changelog
fixed: prevent notification going to unauthorized users