require login for all vendor actions
hide card number from GP logs
fixed features