Understanding Developers' Reasoning about Privacy and Security