[seaf] fixed bug for 'xss' handle