all but creditcard verification and rspec
some refactoring/fixing