Update 2.13.6 release notes

Change-Id: I2fa4e030aa14520189a329b933785ac4af65b511

releases/2.13.md

diff --git a/releases/2.13.md b/releases/2.13.md
index fb69ff0..8b208cb 100644
--- a/releases/2.13.md
+++ b/releases/2.13.md
@@ -467,7 +467,23 @@
   LFS plugins can now provide an implementation of `git-lfs-authenticate`
   which allows the Git LFS client to use the SSH protocol to either obtain
   the LFS endpoint URL or authorize the following LFS upload/download
-  operation
+  operation.
+
+* Allow Git LFS to authenticate via HTTP.
+
+  Git LFS requests include the authorization as HTTP Basic but
+  this was ignored and the user was treated as anonymous.
+
+* Don't require Add Patch Set permission for submit by rebase.
+
+  When the submit strategy was Rebase Always or Rebase If Necessary and
+  a rebase was needed for the submit, the submit failed if the user
+  didn't have the Add Patch Set permission. However for submitting a
+  change the Submit permission alone should be sufficient.
+
+  The behavior is now consistent with the Cherry-Pick submit strategy
+  which also doesn't require the Add Patch Set permission if a
+  cherry-pick is done on submit.
 
 * Add a [passwd program](https://gerrit-documentation.storage.googleapis.com/Documentation/2.13.6/pgm-passwd.html)
 to set values in the `secure.config` file when a secure store implementation