Most places store a token and not your actual CC now. It makes PCI DSS compliance far easier and more secure. There's zero risk to consumers if a token gets compromised. Would just be a matter of the upstream CC processor being secure.

As a web app developer and frequent user of the MBTA site, I was appalled when they rolled out the new site. While it may be totally broken in Opera, it was functionally questionable in IE and FF as well. It's great to update a site, but they made many UI mistakes such as relocating pertinent information under cryptic menus. I'd used the site for the past 18 months and happened to have an urgent need for finding the schedule that day (overslept), and was furious that it was so difficult to find.

I also will say that especially when creating advanced javascript apps, Opera is major pain in the ass (although its gotten better). Still need to support it though... YUI lists it as an A-grade browser.