protect preview url for staff only

otherwise preview is accessible to all