Update notes for submitted changes

* Assign X-Auth-Url header in a separate middleware