Should this be `cart.payments.find`? 

If you don't do that, could someone manipulate the URL and pay with someone else's money?