Rather than having a separate method, this should be hidden behind the interface to `authorize` (and `purchase`) and triggered when a token is passed rather than a credit card.