corrected cancel_url
updated test for cancel_url
Merge pull request #14 from stano/master

Make sure cancel_url requires secret_uuid. Important security fix.