Do retailers need active assailant insurance?