diff --git a/seckit.module b/seckit.module
index d938fb0..0587071 100644
--- a/seckit.module
+++ b/seckit.module
@@ -90,24 +90,27 @@ function _seckit_csp_report_flooding_detected() {
       ->fetchField();
   }
   catch (\Exception $e) {
-    // Table could not exist
+    // Table could not exist.
     $global_count = 0;
     \Drupal::logger('seckit')->warning("Exeption trying to get global count: @message", array('@message' => $e->getMessage()));
   }
 
   if ($global_count >= $global_limit) {
-    return TRUE; // Flooding is in effect
+    // Flooding is in effect.
+    return TRUE;
   }
 
   // Per-user limit.
   $user_limit = $config->get('seckit_advanced.csp_limits.flood.limit_user');
   $user_window = $config->get('seckit_advanced.csp_limits.flood.window_user');
   if (!$flood_service->isAllowed('seckit_csp_report', $user_limit, $user_window)) {
-    return TRUE; // Flooding is in effect
+    // Flooding is in effect.
+    return TRUE;
   }
 
   // Flooding is not in effect. Log this event, and return the status.
   $flood_service->register('seckit_csp_report', $user_window);
 
-  return FALSE; // No flooding
+  // No flooding.
+  return FALSE;
 }
diff --git a/src/Controller/SeckitExportController.php b/src/Controller/SeckitExportController.php
index df26492..848afa5 100644
--- a/src/Controller/SeckitExportController.php
+++ b/src/Controller/SeckitExportController.php
@@ -2,10 +2,8 @@
 
 namespace Drupal\seckit\Controller;
 
-use Drupal\Core\Access\AccessResult;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpFoundation\Request;
-use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
 /**
@@ -19,7 +17,7 @@ class SeckitExportController {
   public function export(Request $request) {
     $config = \Drupal::config('seckit.settings');
     if ($config->get('seckit_advanced.disable_seckit')) {
-      throw new NotFoundHttpException();
+      return new Response();
     }
 
     /*
@@ -32,7 +30,7 @@ class SeckitExportController {
      * are usually ignored to facilitate initial CSP development).
      */
     if (!$config->get('seckit_xss.csp.checkbox')) {
-      throw new NotFoundHttpException();
+      return new Response();
     }
 
     // Only allow POST data with Content-Type application/csp-report
@@ -44,24 +42,24 @@ class SeckitExportController {
       throw new NotFoundHttpException();
     }
     if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
-      throw new NotFoundHttpException();
+      return new Response();
     }
     $pattern = '~^application/(csp-report|json)\h*(;|$)~';
     if (!preg_match($pattern, $_SERVER['CONTENT_TYPE'])) {
-      throw new NotFoundHttpException();
+      return new Response();
     }
 
-    $unlimited_reports = $config->get('seckit_advanced.unlimited_csp_reports');
+    $enforce_limits = !$config->get('seckit_advanced.unlimited_csp_reports');
 
     // Check for flooding.
-    if (!$unlimited_reports && _seckit_csp_report_flooding_detected()) {
+    if ($enforce_limits && _seckit_csp_report_flooding_detected()) {
       // An exception gets logged, if we are preventing for performance reasons
       // we don't want this logged because it could cause a db write if dblog
       // is enabled.
       return new Response();
     }
 
-    if (!$unlimited_reports) {
+    if ($enforce_limits) {
       $max_size = $config->get('seckit_advanced.csp_limits.max_size');
       // Get and parse report.
       $reports = file_get_contents('php://input', FALSE, NULL, 0, $max_size +1);
@@ -79,7 +77,7 @@ class SeckitExportController {
 
     $reports = json_decode($reports);
     if (!is_object($reports)) {
-      throw new NotFoundHttpException();
+      return new Response();
     }
 
     // Log the report data.