J.P. Morgan agrees to pay $1.2 million for ID theft failures