customs_no in email – star out four characters so it's not sent in plaintext - #753

Closes #753