def _create(self, request, *args, **kwargs):
        """
        Handle creation. This is directly called by the @action on AppViewSet,
        allowing the URL to depend on the app id. AppViewSet passes this method
        a Webapp instance in kwargs['app'] (optionally raising a 404 if the
        app in the URL doesn't exist, or a 403 if the app belongs to someone
        else).

        Note: this method is called '_create' and not 'create' because DRF
        would automatically make an 'app-preview-list' url name if this
        method was called 'create', which we don't want - the app-preview-list
        url name needs to be generated by AppViewSet's @action to include the
        app pk.
        """
        app = kwargs['app']

        data_form = PreviewJSONForm(request.data)
        if not data_form.is_valid():
            return Response(data_form.errors, status=HTTP_400_BAD_REQUEST)

        form = PreviewForm(data_form.cleaned_data)
        if not form.is_valid():
            return Response(data_form.errors, status=HTTP_400_BAD_REQUEST)

        form.save(app)
        log.info('Preview created: %s' % form.instance)
        serializer = self.get_serializer(form.instance)
        return Response(serializer.data, status=HTTP_201_CREATED)

    def obj_create(self, bundle, request, **kwargs):
        # Ensure that people don't pass strings through.
        args = PreviewArgsForm(request.GET)
        if not args.is_valid():
            raise self.form_errors(args)

        addon = self.get_object_or_404(Addon,
                                       pk=args.cleaned_data['app'],
                                       type=amo.ADDON_WEBAPP)
        if not AppOwnerAuthorization().is_authorized(request, object=addon):
            raise http_error(http.HttpForbidden,
                             'You are not an author of that app.')

        data_form = PreviewJSONForm(bundle.data)
        if not data_form.is_valid():
            raise self.form_errors(data_form)

        form = PreviewForm(data_form.cleaned_data)
        if not form.is_valid():
            raise self.form_errors(form)

        form.save(addon)
        bundle.obj = form.instance
        log.info('Preview created: %s' % bundle.obj.pk)
        return bundle

    def obj_create(self, bundle, request, **kwargs):
        addon = self.get_object_or_404(Webapp, pk=request.GET.get('app'))
        if not AppOwnerAuthorization().is_authorized(request, object=addon):
            raise ImmediateHttpResponse(response=http.HttpForbidden())

        data_form = PreviewJSONForm(bundle.data)
        if not data_form.is_valid():
            raise self.form_errors(data_form)

        form = PreviewForm(data_form.cleaned_data)
        if not form.is_valid():
            raise self.form_errors(form)

        form.save(addon)
        bundle.obj = form.instance
        log.info('Preview created: %s' % bundle.obj.pk)
        return bundle