Allow more fine-grained control of results for different bogus calls.

This will probably break a few people's tests, but I think it's worth it.

* Instead of just looking at the last digit of the credit card number, each operation is assigned a position in the number.
* For a given method, that method succeeds if the digit in the method's assigned position is 1 (failure if 2, error if 3).
* To make sure the information about which calls should succeed and fail, the methods that return an authorization code returns the last nine digits of the supplied credit card or reference number.
* This leads to being able to devise card numbers like 1111 1111 1121 1121, which you can successfully `store` and `authorize`, but which fails `capture` and `purchase`.