Send the textarea data without CSRF token and use the raw body in the preview function of Controller\App. Reverted the changes to Core\Request and Core\Security to not fiddle around with CSRF tokens anymore.