booking: use form instead of link; allow cancelling; add unique key on slot_id/uid.