make card api more secure, deal with multiple cards