Issue Summary

A user who has been assigned to a system role that has the "Allow access to cancel item" toggle enabled and "Delete" and Add/Save disabled can cancel the work item by clicking the "Cancel item" link.

Steps to Reproduce

1. Go to Administration -> Roles: select a role -> ADDITIONAL OPTIONS and enable the "Allow access to cancel item" toggle 
2. Make sure that the access to Administration -> Roles: select a role -> Portfolio -> Manage > Portfolio Epics (Initiatives): Make sure "Delete" and the "Add/Save" toggles are disabled for this work item (Epics)
3. Same applies for Features (Step 2)
4. Go to the Epics or Feature Grid, open one Epic
5. Click on the More Options -> Cancel Feature
6. A warning pops-up 
7. Click "cancel item(s)"
8. Verify that the Read-only user is able to cancel the work item. (Delete and Add/Save toggles turned off for this user)

Expected Results

The user who has been assigned to a role that has the "Delete" and "Add/Save" toggles disabled for the work item (Epics) should not be able to cancel the work item.

Actual Results

The user who has been assigned to a role that has the "Delete" and "Add/Save" toggles disabled for the work item (Epics) is able to cancel the work item.

Workaround

Currently, there is no known workaround for this behavior. A workaround will be added here when available