Update notes for submitted changes

* Move X-Auth-Url logic to auth_url middleware