Add API to get credit cards for a specific user

The .accessible_by(current_ability, :read) above will authorize the user.

I think we need to change the ability though to:
can :display, CreditCard, user_id: user.id