fix security logic in add_system

had it right in JS...