API endpoint to cancel a booking