The callback shouldn't be running once HttpRequest::Cancel returns.

This covers the case where you're cancelling from the destructor of the
object that is used in the callback. You definitely want Cancel to either
let the callback complete, or never let it run, anything in between would
be Very Bad (tm).