Thank-you! Since the expected permission request pop-up didn't show first time I visited the site, and the address-bar didn't highlight any blocking, and the settings dialog doesn't make it clear whether or not canvas is currently blocked (it has a question and two buttons, neither highlighted) I misinterpreted the default setting.