fix note show, authorize employee -> notes controller