Update notes for submitted changes

* Always hash passwords on their way into the DB