Change the preview iframe to use injected SubsiteID GET/POST params.

Use the CMS domain for fetching the preview content to avoid SSL
errors and single-origin violations on the iframe.