More than skin deep: measuring effects of the underlying model on access-control system usability