fix security logic in add_system

had it right in JS...
BugFix shows details when clicking on system name
Fixed variable name