Validating an Agent-Based Model of Human Password Behavior