When a guest places an order and tries to cancel it from the order
confirmation page, the cancellation silently failed and redirected
to the home page. The guest was left unsure whether the order was
cancelled, and the hub received no cancellation notification.
Root cause: two missing pieces for guest (token-based) authorization:
1. The `:cancel` ability in Ability#add_shopping_abilities only checked
`order.user == user`, ignoring the guest token. The `:read` and
`:update` abilities already support `order.token && token == order.token`
as a fallback — `:cancel` now does the same.
2. The `cancel` action called `authorize! :cancel, @order` without
passing `session[:access_token]`, so even with the corrected ability
the token was never evaluated.
Fixes#13817
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
c72976b1e2