States can play hardball with credit reporting bureaus, CFPB says