[fix] use pagelet.conditional for authorization