Preview page return "Access Denied" when creating a new node

This patch solves the issue by adding a token to the preview link ... hopefully I can get a hold of someone who knows security a little better than I do to verify that this is a good solution, but based on my research it seems like a good fix ...

I discussed this strategy today with @coltrane and he agreed that this was a sound strategy. He did point out that I needed to test what happens if no token is provided at all. I did that, and no exception is thrown in that case; instead the alternative logic of checking if a user has access to edit an entity that references the image in question.

With that, I'm going to mark this as RTBC