Remove credits from user account

[elimisteve]

Accept POST to /currency/api/1/debit with the following JSON schema:

{
  "$schema": "http://json-schema.org/draft-04/schema#",
  "id": "http://sbhx.co/currency/api/1/debit",
  "type": "object",
  "required": false,
  "properties": {
    "card_id": {
      "id": "http://sbhx.co/currency/api/1/debit/card_id#",
      "type": "string",
      "required": false
    },
    "amount_in_cents": {
      "id": "http://sbhx.co/currency/api/1/debit/amount_in_cents#",
      "type": "integer",
      "required": false
    }
  }
}

[elimisteve]

Possible responses:

200: {"success": "Successfully charged. Remaining balance: $12.34"}
400: {"error": "Malformed request: (something more specific here)"}
402: {"error": "Insufficient funds. Please insert coin."}
403: {"error": "Bad signature/Not authorized"}
429: {"error": "Too many requests; slow down!"}

[elimisteve]

Should also include an error when the wrong user is specified. What do you think, @gholms? 400? 404? I'm thinking 404.