diff --git a/resources/static/dialog/controllers/actions.js b/resources/static/dialog/controllers/actions.js
index 3ad9205dea753f08b41d52bc52f7ee5d8ed1bd9b..2a6ea48508b470b26395f356663510167d5e4110 100644
--- a/resources/static/dialog/controllers/actions.js
+++ b/resources/static/dialog/controllers/actions.js
@@ -70,9 +70,7 @@ BrowserID.Modules.Actions = (function() {
     },
 
     doCancel: function() {
-      // do not call success with null here, let winchan's cancel handling do the work.
-      // this gives us consistent semantics across browsers on the RP side of the WinChan.
-      //      if(onsuccess) onsuccess(null);
+      if(onsuccess) onsuccess(null);
     },
 
     doConfirmUser: function(info) {
diff --git a/resources/static/dialog/controllers/required_email.js b/resources/static/dialog/controllers/required_email.js
index 7155951bff5d80eab348c5f86483cc97013d3a6d..67505cbb6aed1a3e0c8df11c62b547aadc4a750e 100644
--- a/resources/static/dialog/controllers/required_email.js
+++ b/resources/static/dialog/controllers/required_email.js
@@ -91,7 +91,10 @@ BrowserID.Modules.RequiredEmail = (function() {
 
 
   function cancel() {
-    this.close(secondaryAuth ? "cancel_state" : "cancel");
+    // The cancel button is only shown to a user who has to enter their
+    // password to go from "assertion" authentication to "password"
+    // authentication.
+    this.close("cancel_state");
   }
 
   var RequiredEmail = bid.Modules.PageModule.extend({
diff --git a/resources/static/dialog/resources/state.js b/resources/static/dialog/resources/state.js
index 6dfa32485ce929e54ebfe992a0efdc95b4b0af00..6fb5c9ec6363dd9475612df059cf354e8f69137a 100644
--- a/resources/static/dialog/resources/state.js
+++ b/resources/static/dialog/resources/state.js
@@ -62,7 +62,9 @@ BrowserID.State = (function() {
     handleState("window_unload", function() {
       if (!self.success) {
         storage.setStagedOnBehalfOf("");
-        startAction("doCancel");
+        // do not call doCancel here, let winchan's cancel
+        // handling do the work. This gives us consistent semantics
+        // across browsers on the RP side of the WinChan.
       }
     });
 
diff --git a/resources/static/test/cases/controllers/required_email.js b/resources/static/test/cases/controllers/required_email.js
index 474adf97a94dfbd014bd6c718258f10c2b6a9554..5a92da544ebd7de3e4a013ac63f7138dfed7475b 100644
--- a/resources/static/test/cases/controllers/required_email.js
+++ b/resources/static/test/cases/controllers/required_email.js
@@ -454,24 +454,7 @@
     });
   });
 
-  asyncTest("cancel normally raises the 'cancel' message", function() {
-    var email = "registered@testuser.com",
-        message = "cancel";
-
-    createController({
-      email: email,
-      ready: function() {
-        register(message, function(item, info) {
-          ok(true, message + " received");
-          start();
-        });
-
-        controller.cancel();
-      }
-    });
-  });
-
-  asyncTest("cancel with 'secondary_auth' raises the 'cancel_state' message", function() {
+  asyncTest("cancel raises the 'cancel_state' message", function() {
     var email = "registered@testuser.com",
         message = "cancel_state";