Add API to get credit cards for a specific user

yea that's what i thought, it was just authorizing that the user can read credit cards at all, not necessarily this specific user's credit cards.