After GAO investigators bought guns online, they worked out a new blueprint for how ATF regulates such sales.