Bayesian Differential Privacy through Posterior Sampling