Fix source type, make non-controller action methods private, use conditional logging method

A few fixes/improvements here. Most important is checking for payment `source_type` against a string (it's a db attribute).