Fix preview ajax/iframe, nonces for all ajax endpoints (#5)