diff --git a/welcome.html b/welcome.html
index b017c77..b365ffb 100644
--- a/welcome.html
+++ b/welcome.html
@@ -97,10 +97,13 @@ var API = '';  // 同源，使用相对路径
 var token = localStorage.getItem('pxh_token');
 
 async function api(method, path, body) {
-  var opts = { method: method, headers: {'Content-Type': 'application/json'} };
-  var t = token || localStorage.getItem('pxh_token');
-  if (t) opts.headers['Authorization'] = 'Bearer ' + t;
-  if (body) opts.body = JSON.stringify(body);
+  var opts = { method: method };
+  if (body) { opts.headers = {'Content-Type': 'application/json'}; opts.body = JSON.stringify(body); }
+  var t = localStorage.getItem('pxh_token');
+  if (t) {
+    if (!opts.headers) opts.headers = {};
+    opts.headers['Authorization'] = 'Bearer ' + t;
+  }
   var r = await fetch(API + path, opts);
   return r;
 }
@@ -245,9 +248,9 @@ async function loadDevices() {
   document.getElementById('sys-status').textContent = '运行中';
   var names = { 'zone.home': '家庭区域', 'person.admin': '管理员' };
   try {
-    if (!token) token = localStorage.getItem('pxh_token');
-    if (!token) { document.getElementById('sys-status').textContent = '未登录 (无token)'; return; }
-    var r = await api('GET', '/api/states');
+    var t = localStorage.getItem('pxh_token');
+    if (!t) { document.getElementById('sys-status').textContent = '未登录'; return; }
+    var r = await fetch(API + '/api/states', { headers: { 'Authorization': 'Bearer ' + t } });
     if (!r.ok) throw new Error('HTTP ' + r.status + ' ' + r.statusText);
     var states = await r.json();