Add API to get credit cards for a specific user

@huoxito scoping from the user was my initial thought as well, but I was thinking people may want to access the credit cards api without specifying a user.  Thinking about it again though the only available route is nested through the users resource.

So I think we should change this to:
```
@credit_cards = @user.credit_cards
		  .accessible_by(current_ability, :read)
		  .with_payment_profile
		  .ransack(params[:q]).result.page(params[:page]).per(params[:per_page])
```
since the user should always be present based on the nested routing.  It's probably best not to open this endpoint up to being able to pull down all credit cards regardless of user.

@MisinformedDNA with the way CanCan the permission library works when you say:
can :display, CreditCard

You are opening up access for the user to display all credit card objects because you have not specified any condition.  When you add the `user_id: user.id` your then making it so that the user can only access their own credit cards by making that a condition.  So this is necessary to restrict a users unauthorized access rather than granting it to them for all CreditCard objects.