ExecuteAsync does not take the CancellationToken. This looks like an oversight, because the default controller action implementation uses model binding to propagate the cancellation token into any async actions, but we shouldn't be making that assumption at this level of abstraction.