diff --git a/apps/routerconsole/java/src/net/i2p/router/web/CSSHelper.java b/apps/routerconsole/java/src/net/i2p/router/web/CSSHelper.java
index d4f825a9a..ffc77f71b 100644
--- a/apps/routerconsole/java/src/net/i2p/router/web/CSSHelper.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/CSSHelper.java
@@ -11,6 +11,8 @@ public class CSSHelper extends HelperBase {
     public static final String DEFAULT_THEME = "light";
     private static final String BASE = "/themes/console/";
     private static final String FORCE = "classic";
+    public static final String PROP_REFRESH = "routerconsole.summaryRefresh";
+    public static final String DEFAULT_REFRESH = "60";
 
     public String getTheme(String userAgent) {
         String url = BASE;
@@ -34,6 +36,17 @@ public class CSSHelper extends HelperBase {
         return Messages.getLanguage(_context);
     }
 
+    /** change refresh and save it */
+    public void setRefresh(String r) {
+        _context.router().setConfigSetting(PROP_REFRESH, r);
+        _context.router().saveConfig();
+    }
+
+    /** @return refresh time in seconds, as a string */
+    public String getRefresh() {
+        return _context.getProperty(PROP_REFRESH, DEFAULT_REFRESH);
+    }
+
     /** translate the title and display consistently */
     public String title(String s) {
          StringBuilder buf = new StringBuilder(128);
diff --git a/apps/routerconsole/jsp/summary.jsi b/apps/routerconsole/jsp/summary.jsi
index fcab70132..29be51989 100644
--- a/apps/routerconsole/jsp/summary.jsi
+++ b/apps/routerconsole/jsp/summary.jsi
@@ -6,10 +6,12 @@
     String d = request.getParameter("refresh");
     String newDelay = "";
     if (d == null || "".equals(d))
-        d = System.getProperty("routerconsole.summaryRefresh");
-    else
+        d = intl.getRefresh();
+    else {
+        d = net.i2p.data.DataHelper.stripHTML(d);  // XSS
         // pass the new delay parameter to the iframe
         newDelay = "?refresh=" + d;
+    }
     if (!"0".equals(d))
         out.print("<iframe src=\"/summaryframe.jsp" + newDelay + "\" height=\"1500\" width=\"200\" scrolling=\"auto\" frameborder=\"0\" title=\"sidepanel\">\n");
 %>
@@ -25,13 +27,11 @@
         out.print("<div class=\"refresh\"><form action=\"" + request.getRequestURI() + "\" method=\"GET\">\n");
         out.print("<b>");
         // We have intl defined when this is included, but not when compiled standalone.
-        // Not that we really need it standalone, but I can't figure out how to keep
-        // this from being compiled by JspC in the build file.
-        out.print(net.i2p.router.web.Messages.getString("Refresh (s)", net.i2p.I2PAppContext.getGlobalContext()));
-        out.print(":</b> <input size=\"3\" type=\"text\" name=\"refresh\" value=\"60\" />\n");
+        out.print(intl._("Refresh (s)"));
+        out.print(":</b> <input size=\"3\" type=\"text\" name=\"refresh\" value=\"60\" >\n");
         out.print("<button type=\"submit\" value=\"Enable\" >");
         // ditto
-        out.print(net.i2p.router.web.Messages.getString("Enable", net.i2p.I2PAppContext.getGlobalContext()));
+        out.print(intl._("Enable"));
         out.print("</button>\n");
         out.print("</form></div></div>\n");
     }
diff --git a/apps/routerconsole/jsp/summaryframe.jsp b/apps/routerconsole/jsp/summaryframe.jsp
index a0123fe6f..867678299 100644
--- a/apps/routerconsole/jsp/summaryframe.jsp
+++ b/apps/routerconsole/jsp/summaryframe.jsp
@@ -19,11 +19,10 @@
                            "Shutdown immediately".equals(action) || "Restart immediately".equals(action);
     if (!shutdownSoon) {
         if (d == null || "".equals(d)) {
-            d = System.getProperty("routerconsole.summaryRefresh");
-            if (d == null || "".equals(d))
-                d = "60";
+            d = intl.getRefresh();
         } else {
-            System.setProperty("routerconsole.summaryRefresh", d);
+            d = net.i2p.data.DataHelper.stripHTML(d);  // XSS
+            intl.setRefresh(d);
         }
         // we probably don't get here if d == "0" since caught in summary.jsi, but just
         // to be sure...
@@ -42,7 +41,7 @@
             long delay = 60;
             try { delay = Long.parseLong(d); } catch (NumberFormatException nfe) {}
             if (delay*1000 < timeleft + 5000)
-                out.print("<meta http-equiv=\"refresh\" content=\"" + d + "\" />\n");
+                out.print("<meta http-equiv=\"refresh\" content=\"" + d + "\" >\n");
             else
                 shutdownSoon = true;
         }
@@ -57,13 +56,13 @@
         if ("0".equals(d)) {
             out.print("<b>");
             out.print(intl._("Refresh (s)"));
-            out.print(":</b> <input size=\"3\" type=\"text\" name=\"refresh\" value=\"60\" />\n");
+            out.print(":</b> <input size=\"3\" type=\"text\" name=\"refresh\" value=\"60\" >\n");
             out.print("<button type=\"submit\" value=\"Enable\" >");
             out.print(intl._("Enable"));
             out.print("</button></div>\n");
         } else {
             // this will load in the iframe but subsequent pages will not have the iframe
-            out.print("<input type=\"hidden\" name=\"refresh\" value=\"0\" />\n");
+            out.print("<input type=\"hidden\" name=\"refresh\" value=\"0\" >\n");
             out.print("<button type=\"submit\" value=\"Disable\" >");
             out.print(intl._("Disable {0}s Refresh", d));
             out.print("</button></div>\n");