this route, plus its file, needs to live on its own domain, like `preview.webmaker.org` or something that causes domain isolation