Cause I redirect the customer to Stripe hosted page. I'd really prefer not to go into the whole PCI DSS thing for this. Also, why should I jump through hoops when it's Stripe that chooses to make life harder for me? I'd rather find a better alternative.