Thanks, tP. I'm almost there... and it's working out better than expected! I just reviewed the PCI security standards and found out that it's only against their rules to not store sensitive authentication data subsequent to authentication. In all honesty, this means that it's possible to be totally PCI compliant right now... and of course we'll be stellar once the changes come into core!