I didn't follow every link you included, and didn't expect to argue about this – also, I didn't realize this was your post, my bad!

You can ignore my comment about the /payments page, I'll assume you checked that, so yeah, that's insane if you can update payment information on an insecure page.