Dancing Pigs or Externalities?: Measuring the Rationality of Security Decisions