The Cancellations controller is now behind authentication - needs a test for that