Prioritizing Security Practices via Large-Scale Measurement of User Behavior