Wrong firmware address while write data to spi flash

I found this bug, hope this help. 
cgiflash.c line 180, 
change `state->address=def->fw1Pos;` to

```
if (system_upgrade_userbin_check()==1) {
     state->address=def->fw1Pos;
} else {
    state->address=def->fw2Pos;
}
```

Don't forget include "upgrade.h"
