Update notes for submitted changes

* auth_token hashes PKI token once