membership created and marked current when transaction declined (authorize.net)

to set this up:

• create a contribution page with payment processing and the membership options enabled. I used an authorize.net account, but don't know if it's unique to that processor or common to all.

• visit the page, complete the form, but use a wrong address for the billing name/address in order to trigger the card decline

• the form returns the payment process error message and returns you to the first step of the process so you can correct the address – which is expected and the correct behavior.

• however – if you view the backend, you'll see that a membership record was created for the contact, no contribution was created, and the membership was given a current status (either new or current, depending on your config).

if the transaction fails when completing the contribution form, we should not be creating any membership record at all. the user has been returned to the form in order to fix the problem and proceed with attempting to submit it again.

I'm prioritizing this as a blocker to 4.5 because I think it has the potential to really screw up membership and payment records.