Update 2.15.14 release notes

Change-Id: Icc2ed635cd43ff611bbeb916535ac142d546a4ae
diff --git a/pages/site/releases/2.15.md b/pages/site/releases/2.15.md
index 8fdfa9e..6e9cedb 100644
--- a/pages/site/releases/2.15.md
+++ b/pages/site/releases/2.15.md
@@ -447,6 +447,22 @@
 
   * A progress indicator counts every 100 accounts migrated.
 
+* [Issue 10790](https://bugs.chromium.org/p/gerrit/issues/detail?id=10790):
+Avoid evaluating submit rules twice for open changes.
+
+  Prolog submit rules were evaluated twice per page view for an open change,
+  which caused performance degradation on projects defining complex rules.
+
+* [Issue 10943](https://bugs.chromium.org/p/gerrit/issues/detail?id=10943):
+Set `References:` header on new change notification mail.
+
+  GMail changed the way
+  [emails are grouped in conversation view](https://gsuiteupdates.googleblog.com/2019/03/threading-changes-in-gmail-conversation-view.html),
+  which, combined with the fact that
+  [Amazon SES changes the `Message-ID` header](https://forums.aws.amazon.com/message.jspa?messageID=262855),
+  resulted in the new change notification email not being grouped with
+  subsequent emails related to the same change.
+
 * [Issue 10952](https://bugs.chromium.org/p/gerrit/issues/detail?id=10952):
 Fix definition of `PID` in `gerrit.sh`.
 
@@ -456,15 +472,16 @@
   notification email for addition of new keys was always sent, even if the
   update only removed keys.
 
-* Add email notifications on changing security related settings.
+* Update email notifications on changing security related settings.
 
-  Email notifications are sent when
+  Email notifications are now sent when a GPG or SSH key is removed, and
+  when the HTTP password is deleted or changed.
 
-  - A GPG or SSH key is removed
-  - The HTTP password is deleted or changed
+  An email notification is now always sent when an SSH key is added to an
+  account, even when it was added by an administrator.
 
-  This allows to alert the user if their account is compromised and keys
-  or password altered by an attacker.
+  These notifications allow to alert the user if their account is compromised
+  and keys or password are altered by the attacker.
 
 * Remove explicit dependency on protobuf_java.