Shouldn't the cvc be sent even if the track data is present?  It's not part of the track data, and I would expect Stripe to take it in addition to the track data for verification purposes.