cvv2 isn't actually required like the docs say