BridgeSecret is 0 when cordova js is injected as inline script

The injectview plugin looks great to me because I want to open an external website.
The plugin injects cordova and its plugin js into the webview as inline script. I got device ready event and the cordova demo app looks good.
However, I found out I can't not use things like navigator.camera.getPicture or navigator.notification.alert. After ruling out common mistake and I start to step the code.
It turns out the bridgesecret in the js is 0 so it doesn't pass the

if (!verifySecret("exec()", bridgeSecret)) {
    return null;
}

in CordovaBridge.java. If I comment out these three lines, things may works fine. but some callback such as camera won't fire.
If I don't use remote website but use local www, this works fine.(without remove the injectView plugin).
I think the issue has something to do with the code injection plugin.

Any thought?