Fix security issue with Credit Card API

Right now, if an admin user accesses the endpoint `/user/#{id}/credit_cards`, all credit cards from all users are sent back. Given that `credit_cards` is under `user`, this is unexpected behavior and resulted in all customers seeing all CCs for all users in PROD. This was obviously **very bad**. There wasn't full CC details or tokens exposed, but it did allow other users to make purchases with other people's credit cards. Luckily that didn't happen as it was caught early, unfortunately, by a customer.

This should get merged into 2-3-stable and master.