fixes CSRF when starring packages
adds preview banner to top of each page