Update notes for submitted changes

* Change exception type from HTTPBadRequest to HTTPForbidden