Add API to get credit cards for a specific user

i may be missing something, but this seems insecure to me.