OrderPaymentFinder was re-fetching the payment object from the database, so the subsequent line that stubs #authorize! on that payment was not being applied to the correct object.