Thanks, that makes sense!
I re-read the section of mirroring. I missed that part.
Our application is not suitable to failover automatically. This is why I did not add the witness, as I though we have to break the mirror manually anyway.
It looks like having a witness will be better.
Thanks again!
-Yuemo