Supporting Password-Security Decisions with Data