Make CVV length check dependent on issuer

American Express uses a 4 digit security code, while
all other issuer only need 3 digits