Update notes for submitted changes

* Fix middleware to not access session fields without user auth