Add API to get credit cards for a specific user

why not scope the cards from the user instead of relying on accessible by?

also this should be targetting master not 2-3-stable