The online travel agent could be taken to court unless it pays £1m of refunds, the regulator says.