auth.net sometimes uses 4 digits and sometimes XXXXdddd so always truncate to 4, and force live mode when talking to the test gateway to get testable data