Retailers are relying on customers to be honest about their vaccination status. Is it legal for them to ask?