I propose "is_preview" is true only when you are logged in 

is_preview is true when you access ?_preview=1 .
That means, users who are not logged in, can view non published page. This might cause a leakage of information.