I noticed that the cancel endpoint does not contain the session ID. According to the documentation, it should.
When I send one or more files to a client and the client is shown the Decline/Accept popup and at the same time the sender cancels, then the REST endpoint "v2/cancel" is called and not "v2/cancel?sessionId={sessionId}".
I have solved it now by implementing 2 cancel endpoints (I am making a UWP client for Windows 10 Mobile), but it would be nice if this was fixed.