diff --git a/lib/http-worker.js b/lib/http-worker.js
index cad694ac2..121471577 100644
--- a/lib/http-worker.js
+++ b/lib/http-worker.js
@@ -21,8 +21,6 @@ const guid = () => {
 const sendMessage = (msg, cb, opt) => {
     var txid = guid();
     var timeout = (opt && opt.timeout) || DEFAULT_QUERY_TIMEOUT;
-
-    /// XXX don't nest
     var obj = {
         pid: PID,
         txid: txid,
@@ -31,7 +29,6 @@ const sendMessage = (msg, cb, opt) => {
     response.expect(txid, cb, timeout);
     process.send(obj);
 };
-
 const Log = {};
 Logger.levels.forEach(level => {
     Log[level] = function (tag, info) {
@@ -74,14 +71,6 @@ EVENTS.FLUSH_CACHE = function (data) {
 };
 
 process.on('message', msg => {
-    // XXX
-/*
-    console.log({
-        _: 'Message from main process to worker',
-        msg: msg,
-        pid: process.pid,
-    });
-*/
     if (!(msg && msg.txid)) { return; }
     if (msg.type === 'REPLY') {
         var txid = msg.txid;
@@ -94,8 +83,7 @@ process.on('message', msg => {
             return void ev(msg.data, () => {});
         }
     }
-    console.error("UNHANDLED_MESSAGE", msg);
-    // XXX unhandled
+    console.error("UNHANDLED_MESSAGE", msg); // XXX
 });
 
 
@@ -190,10 +178,12 @@ const wsProxy = createProxyMiddleware({
 
 app.use('/cryptpad_websocket', wsProxy);
 
+
 app.use('/blob', function (req, res, next) {
-    // XXX update atime?
+/*  Head requests are used to check the size of a blob.
+    Clients can configure a maximum size to download automatically,
+    and can manually click to download blobs which exceed that limit.  */
     if (req.method === 'HEAD') {
-        console.log(`Blob head: ${req.url}`);
         Express.static(Path.resolve(Env.paths.blob), {
             setHeaders: function (res /*, path, stat */) {
                 res.set('Access-Control-Allow-Origin', Env.enableEmbedding? '*': Env.permittedEmbedders);
@@ -202,16 +192,34 @@ app.use('/blob', function (req, res, next) {
             }
         })(req, res, next);
         return;
-    } else {
-        console.log(`Blob !head: ${req.url}`);
     }
+
+/*  Some GET requests concern the whole file,
+    others only target ranges, either:
+
+    1. a two octet prefix which encodes the length of the metadata in octets
+    2. the metadata itself, excluding the two preceding octets
+*/
+
+/*
+    // Example code to demonstrate the types of requests which are handled
+    if (req.method === 'GET') {
+        if (!req.headers.range) {
+            // metadata
+        } else {
+            // full request
+        }
+    }
+*/
+
     next();
 });
 
 app.use(function (req, res, next) {
-    // XXX update atime?
+/*  These are pre-flight requests, through which the client
+    confirms with the server that it is permitted to make the
+    actual requests which will follow */
     if (req.method === 'OPTIONS' && /\/blob\//.test(req.url)) {
-        console.log(`Blob options: ${req.url}`);
         res.setHeader('Access-Control-Allow-Origin', Env.enableEmbedding? '*': Env.permittedEmbedders);
         res.setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS');
         res.setHeader('Access-Control-Allow-Headers', 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Access-Control-Allow-Origin');
diff --git a/server.js b/server.js
index 9983ceb79..1ea944044 100644
--- a/server.js
+++ b/server.js
@@ -107,8 +107,8 @@ nThen(function (w) {
         worker.on('message', msg => {
             if (!msg) { return; }
             var txid = msg.txid;
-            var content = msg.content; // XXX don't nest
-            if (!content) { return; } // XXX
+            var content = msg.content;
+            if (!content) { return; }
 
             var command = COMMANDS[content.command];
             if (typeof(command) !== 'function') {