oops we should not even hash the cvc
pledge authtest and capture (wip)
refactor transactions and use Decimal math