[sah88]

You would think if you're using the live secret code server side it would reject charge tokens coming from the public test code.

edit: To be clear I haven't tested this and don't have time today with xmas and such.