Firms Look to Limit Liability for Online Security Breaches