diff --git a/IPython/html/services/security/__init__.py b/IPython/html/services/security/__init__.py
index c660a56..9cf0d47 100644
--- a/IPython/html/services/security/__init__.py
+++ b/IPython/html/services/security/__init__.py
@@ -1 +1,4 @@
+# URI for the CSP Report. Included here to prevent a cyclic dependency.
+# csp_report_uri is needed both by the BaseHandler (for setting the report-uri)
+# and by the CSPReportHandler (which depends on the BaseHandler).
 csp_report_uri = r"/api/security/csp-report"
diff --git a/IPython/html/services/security/handlers.py b/IPython/html/services/security/handlers.py
index 120279f..e33fe83 100644
--- a/IPython/html/services/security/handlers.py
+++ b/IPython/html/services/security/handlers.py
@@ -6,6 +6,7 @@
 from tornado import gen, web
 
 from ...base.handlers import IPythonHandler, json_errors
+from . import csp_report_uri
 
 class CSPReportHandler(IPythonHandler):
     '''Accepts a content security policy violation report'''
@@ -16,8 +17,6 @@ class CSPReportHandler(IPythonHandler):
         csp_report = self.get_json_body()
         self.log.debug(csp_report)
 
-csp_report_uri = r"/api/security/csp-report" 
-
 default_handlers = [
     (csp_report_uri, CSPReportHandler)
 ]