When application security and good private models work together, users are easiest