Remove check_authorization so that non-admins can add notes

Note-specific auth is already checked with the :verify_permissions before_filter, or in the actions themselves.