There are different examples for async controllers. Some of them use CancellationToken in method definition:
public async Task<ActionResult> ShowItem(int id, CancellationToken cancellationToken)
{
await Database.GetItem(id, cancellationToken);
...
But other examples and even the default ASP.NET projects for VS2013 don't use CancellationToken at all and work without it:
public async Task<ActionResult> ShowItem(int id)
{
await Database.GetItem(id);
...
It's not clear, if we should use CancellationToken in controllers or not (and why).