US city balks at paying $5.3 million ransomware demand