Predicted and Observed User Behavior in the Weakest-link Security Game