fix bug

needs 'systemXHR' permission
option html is not correct