[shkkmo]

The last four digits are still plenty sensitive enough to make serving them over http blatantly irresponsible.

[chris_wot]

It's not just that - it allows you to update your credit card over unencrypted http.