I was under the impression that using something like authorize.net would impose more restrictions on my application (e.g.: require it to be PCI compliant, etc.) and require more work to get going.