Lack of proper paymentProfileUUID validation allows any number of free rides without any outstanding balance

Summary

@eequalsmc2 discovered that when requesting a ride, it was possible to intercept the request and forward it with 3 random characters at the end of the paymentProfileUuid parameter. This would cause the ride to disappear from both the Rider and Driver's trip history, the Rider would not be charged, and the Driver would not receive payment for the trip.

Our $1500 bounty for this report is higher than our typical bounty for fraud-related issues, which reflects the novel attack scenario presented in this report and potential impact to our driver partners.