make sure payments have required attributes on controller

```cc_type``` was missing from the new payment form and it from the permitted attributes on the controller, I added the ```permitted_paymen_attributes``` that is being used on the checkouts controller of the frontend, please correct me if that's wrong.

this fixes #4276