Funny I had assumed that /CS wouldn't need a pull-up...I suppose if the chip is unselected then it will ignore input on the clock/data lines anyway.
As for the card detect pins, there are no more pins available to connect them to, so the pullup would have to be external.