diff --git a/q2cli/builtin/tools.py b/q2cli/builtin/tools.py
index 7b809f64..21e2e802 100644
--- a/q2cli/builtin/tools.py
+++ b/q2cli/builtin/tools.py
@@ -559,6 +559,13 @@ def view(result_path, port):
     if not os.path.exists(extracted_path):
         result.extract(result_path, tempfile.gettempdir())
 
+
+    # This ought to look like a session id generated by normal view
+    CHAR_SET = 'abcdefghijklmnopqrstuvwxyz0123456789'
+    SESSION_LEN = 11
+    session = ''.join(random.choice(CHAR_SET) for i in range(SESSION_LEN))
+
+    # Start server
     class Handler(http.server.SimpleHTTPRequestHandler):
         def do_GET(self):
             # Determine if this is a request for the file we are supposed to be
@@ -570,6 +577,8 @@ def do_GET(self):
                     self.send_response(200)
                     with open(self.path, 'rb') as file:
                         self.wfile.write(file.read())
+            # Determine if this is a request for a file within the
+            # visualization
             elif self.path.startswith(f'/_/{session}/{result.uuid}/'):
                 file_path = self.path.split(str(result.uuid))[1]
                 file_path = extracted_path + file_path
@@ -585,16 +594,13 @@ def do_GET(self):
 
                     with open(file_path, 'rb') as file:
                         self.wfile.write(file.read())
+            # Otherwise default to super class. This will respond appropriately
+            # to requests for assets that are part of the vendored view app and
+            # will reject any requests for files outside the served directory
             else:
                 super().do_GET()
 
     VENDOR_PATH = '/home/anthony/src/qiime2/q2view/vendored/'
-    # This ought to look like a session id generated by normal view
-    CHAR_SET = 'abcdefghijklmnopqrstuvwxyz0123456789'
-    SESSION_LEN = 11
-    session = ''.join(random.choice(CHAR_SET) for i in range(SESSION_LEN))
-
-    # Start server
     server = http.server.HTTPServer(
         ('', port), lambda *_: Handler(*_, directory=VENDOR_PATH))
     click.echo(f'Agent started on port: {port}')