Add CSRF token to preview POST