Go Cardless: minor security/privacy consideration