diff --git a/srv/src/http/api.go b/srv/src/http/api.go
index bbf4419..4740853 100644
--- a/srv/src/http/api.go
+++ b/srv/src/http/api.go
@@ -222,7 +222,9 @@ func (a *api) handler() http.Handler {
 				"DELETE": authMiddleware(auther,
 					formMiddleware(a.deletePostHandler()),
 				),
-				"PREVIEW": formMiddleware(a.previewPostHandler()),
+				"PREVIEW": authMiddleware(auther,
+					formMiddleware(a.previewPostHandler()),
+				),
 			}),
 		))
 		v2Mux.Handle("/assets/", http.StripPrefix("/assets",