I'm not sure that is correct; should this be done for every payment request, or just when the merchant is authenticated (ie "secure payment")? 
Same for the other similar changes below.