A Methodology for Evaluating the Strength of Cued-recall Graphical Passwords