Scope Credit Card API to user_id.

Fixes #5232