I found a solution... going to post it here for other people:
Go to Admin Tools, Web Application Firewall, Configure WAF and find the "List of allowed tmpl= keywords" setting and add the word cart so it looks like: component,raw,cart may also say: component,raw,cart,system
Save and close - my cart link should work then.