Retailers can't request cardholders' ZIP code