Accept .
as a query string delimiter and reject non-alphanumeric card_id
parameters
#1265
+125
−13