It was a server-side block, from Cloudflare. I’m very familiar with it, having used the same service over a decade. You are able to tweak the overall security level, or specific WAF rules in Cloudflare. They also have analytics that will show them exactly how many cancellation requests would be blocked. The fact that they totally ignored these details in my ticket, is concerning.