protect preview url for staff only

otherwise preview is accessible to all
Merge pull request #28 from dfeinzeig/patch-1

protect preview url for staff only