don't validate non-existent ccards when capturing preauths that may have been created externally (and fix a typo)