avoid extra redirect; correctly show auth.net errors on failed transaction

This fixes #30. It avoids an extra redirect, and in so doing preserves the error messages for the end user.

One day we should show them via SweetAlert...