I suppose it could do that now. I did it this way so there wouldn't be a change to the way webpay currently works but if webpay is changing the PIN it probably wants to set `pin_confirmed` to `False` too.