pull down to refresh

And running user control html on client side is dangers. (Cross side scripting)