fix(admin-ui): attach CSRF header to import preview and configuration writes (#6161)