TSA facial recognition scans are optional on paper, mandatory in practice